Lucene search
K
Database
Vendors
Products
Years
CVSS
Scanner
Agent Scanning
API Scanning
Manual Audit
Perimeter Scanner
Scanning
Projects
Email
Webhook
Plugins
Resources
Documents
Blog
Glossary
FAQ
Pricing
Contacts
About Us
Partners
Branding Guideline
ibmIBM766340AFDCA95E3272150E01DE0CF631FCD6DA67C85BA4E6499910ECCBB67F1D
HistoryJul 18, 2022 - 3:29 p.m.

Security Bulletin: IBM UrbanCode Build is vulnerable to a bypass of security restrictions due to use of Apache Tomcat (CVE-2022-25762).

2022-07-1815:29:10
www.ibm.com
11

8.6 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

LOW

Availability Impact

LOW

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L

7.5 High

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

0.006 Low

EPSS

Percentile

78.3%

JSON

Summary

Apache Tomcat is used by IBM UrbanCode Build. This fix includes Apache Tomcat 8.5.79.

Vulnerability Details

CVEID:CVE-2022-25762
**DESCRIPTION:**Apache Tomcat could allow a remote attacker to bypass security restrictions, caused by improper error handling in WebSocket connection. By sending a specially-crafted WebSocket message concurrently with the WebSocket connection closing, an attacker could exploit this vulnerability to continue to use the socket after it has been closed.
CVSS Base score: 8.6
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/226498 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L)

Affected Products and Versions

Affected Product(s) Version(s)
IBM UrbanCode Build 6.1.4.0 - 6.1.7.3

Remediation/Fixes

IBM strongly recommends addressing the vulnerability now by upgrading to IBM UrbanCode Build version 6.1.7.5 or above.

Affected Supporting Product(s) Remediation/Fix
IBM UrbanCode Build 6.1.4.0 - 6.1.7.3 Download IBM UrbanCode Build 6.1.7.5 – Includes Tomcat 8.5.79

Workarounds and Mitigations

None

CPENameOperatorVersion
rationaleq6.1.4.0
rationaleq6.1.7.5

Related

nessus 10
prion 1
ibm 6
osv 4
f5 1
cnvd 1
veracode 1
github 1
debiancve 1
tomcat 2
ubuntucve 1
cve 1
redhatcve 1
amazon 1
rocky 1
rosalinux 1
redhat 1
oracle 1
nessus
nessus
Apache Tomcat 9.0.0.M1 < 9.0.21 vulnerability
2022-05-13 00:00:00
Apache Tomcat 8.5.0 < 8.5.76 vulnerability
2022-05-13 00:00:00
Amazon Linux AMI : tomcat8 (ALAS-2022-1627)
2022-08-05 00:00:00
prion
prion
Code injection
2022-05-13 08:15:00
ibm
ibm
Security Bulletin: IBM UrbanCode Release is vulnerable to a bypass of security restrictions due to use of Apache Tomcat (CVE-2022-25762).
2022-07-18 15:23:29
Security Bulletin: Vulnerability in Apache Tomcat affects IBM SAN Volume Controller, IBM Storwize, IBM Spectrum Virtualize and IBM FlashSystem products
2023-03-29 01:48:02
Security Bulletin: Vulnerabilities in Apache Tomcat, Apache Commons FileUpload and Apache Axis might affect IBM Storage Copy Data Management
2024-03-22 16:05:48
osv
osv
Improper socket reuse in Apache Tomcat
2022-05-14 00:01:50
BIT-tomcat-2022-25762
2024-03-06 11:09:31
CVE-2022-25762
2022-05-13 08:15:06
f5
f5
K49622415 : Apache Tomcat vulnerability CVE-2022-25762
2022-07-07 00:00:00
cnvd
cnvd
Apache Tomcat Request Obfuscation Vulnerability
2022-05-17 00:00:00
veracode
veracode
Command Injection
2022-09-05 19:23:03
github
github
Improper socket reuse in Apache Tomcat
2022-05-14 00:01:50
debiancve
debiancve
CVE-2022-25762
2022-05-13 08:15:00
tomcat
tomcat
Fixed in Apache Tomcat 9.0.21
2019-06-07 00:00:00
Fixed in Apache Tomcat 8.5.76
2022-02-28 00:00:00
ubuntucve
ubuntucve
CVE-2022-25762
2022-05-13 00:00:00
cve
cve
CVE-2022-25762
2022-05-13 08:15:00
redhatcve
redhatcve
CVE-2022-25762
2022-05-13 00:41:04
amazon
amazon
Important: tomcat8
2022-07-28 20:39:00
rocky
rocky
pki-core:10.6 and pki-deps:10.6 security, bug fix, and enhancement update
2020-11-03 12:29:58
rosalinux
rosalinux
Advisory ROSA-SA-2023-2258
2023-10-21 16:49:43
redhat
redhat
(RHSA-2020:4847) Moderate: pki-core:10.6 and pki-deps:10.6 security, bug fix, and enhancement update
2020-11-03 12:29:58
oracle
oracle
Oracle Critical Patch Update Advisory - July 2022
2022-07-19 00:00:00

8.6 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

LOW

Availability Impact

LOW

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L

7.5 High

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

0.006 Low

EPSS

Percentile

78.3%

JSON
Related for 766340AFDCA95E3272150E01DE0CF631FCD6DA67C85BA4E6499910ECCBB67F1D
nessus10prion1ibm6osv4f51cnvd1veracode1github1debiancve1tomcat2ubuntucve1cve1redhatcve1amazon1rocky1rosalinux1redhat1oracle1