Security Bulletin: IBM Spectrum Control is vulnerable to multiple weaknesses related to Node [CVE-2022-39353]

Summary

Vulnerabilities in xmldom module may compromise the authentication mechanism of the Spectrum Control Product. [CVE-2022-39353] This vulnerability has been addressed.

Vulnerability Details

CVEID:CVE-2022-39353
**DESCRIPTION:**Node.js xmldom module could allow a remote attacker to bypass security restrictions, caused by the use of multiple top level elements. By sending a specially-crafted request, an attacker could exploit this vulnerability to bypass authentication and obtain administrative access.
CVSS Base score: 9.4
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/239426 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H)

Affected Products and Versions

Remediation/Fixes

IBM strongly suggests the following remediation / fix:

Workarounds and Mitigations

None