Security Bulletin: UrbanCode Deploy users with create-resource permission for the standard resource type may create child resources inheriting custom types (CVE-2022-22315).

2022-04-2619:26:29

www.ibm.com

ibm urbancode deploy

create-resource permission

standard resource type

custom resource type

elevated privileges

cve-2022-22315

6.2.7.15

7.0.5.10

7.1.2.6

7.2.2.1

EPSS

0.001

Percentile

39.9%

JSON

Summary

Users in UrbanCode Deploy with create-resource permission for the standard resource type but not for a custom resource type, may create child resources inheriting that custom type.

Vulnerability Details

CVEID:CVE-2022-22315
**DESCRIPTION:**IBM UrbanCode Deploy (UCD) could allow an authenticated user with special permissions to obtain elevated privileges due to improper handling of permissions.
CVSS Base score: 5
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/217955 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L)

Affected Products and Versions

Affected Product(s)	Version(s)
UCD - IBM UrbanCode Deploy	6.2.7.0 - 6.2.7.14
UCD - IBM UrbanCode Deploy	7.0.3.0 - 7.0.3.3
UCD - IBM UrbanCode Deploy	7.0.4.0 - 7.0.4.2
UCD - IBM UrbanCode Deploy	7.0.5.0 - 7.0.5.9
UCD - IBM UrbanCode Deploy	7.1.0.0 - 7.1.0.2
UCD - IBM UrbanCode Deploy	7.1.1.0 - 7.1.1.2
UCD - IBM UrbanCode Deploy	7.1.2.1 - 7.1.2.5
UCD - IBM UrbanCode Deploy	7.2.0.0 - 7.2.0.2
UCD - IBM UrbanCode Deploy	7.2.1.0 - 7.2.1.2
UCD - IBM UrbanCode Deploy	7.2.2.0