Lucene search
K
Database
Vendors
Products
Years
CVSS
Scanner
Agent Scanning
API Scanning
Manual Audit
Perimeter Scanner
Scanning
Projects
Email
Webhook
Plugins
Resources
Documents
Blog
Glossary
FAQ
Pricing
Contacts
About Us
Partners
Branding Guideline
ibmIBM878E7A7932F19F58853CFC5A17186F8337CDBC16A9F6A3535F0697F29B91EA5B
HistoryApr 05, 2023 - 8:33 p.m.

Security Bulletin: decode-uri-component is vulnerable to CVE-2022-38900 used in IBM Maximo Application Suite

2023-04-0520:33:59
www.ibm.com
18

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

5 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:N/I:N/A:P

0.002 Low

EPSS

Percentile

55.7%

JSON

Summary

IBM Maximo Application Suite uses decode-uri-component which is vulnerable to CVE-2022-38900.

Vulnerability Details

CVEID:CVE-2022-38900
**DESCRIPTION:**decode-uri-component is vulnerable to a denial of service, caused by improper input validation by the decodeComponents function. By sending a specially-crafted request, a remote attacker could exploit this vulnerability to cause the application to crash.
CVSS Base score: 7.5
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/241069 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)

Affected Products and Versions

Affected Product(s) Version(s)
IBM Maximo Application Suite 8.8
IBM Maximo Application Suite 8.9

Remediation/Fixes

Affected Product(s) fix pack Version(s)
IBM Maximo Application Suite 8.8.7 or latest (available from the Catalog under Update Available)
IBM Maximo Application Suite 8.9.3 or latest (available from the Catalog under Update Available)

Workarounds and Mitigations

None

Related

veracode 1
nessus 17
fedora 5
redhatcve 1
redhat 8
almalinux 2
oraclelinux 2
openvas 6
osv 6
ibm 14
cve 2
prion 2
github 1
rocky 1
veracode
veracode
Denial Of Service (DoS)
2022-11-29 02:52:14
nessus
nessus
Fedora 37 : pcs (2023-ae96dd6105)
2023-07-01 00:00:00
RHEL 9 : pcs (RHSA-2023:6316)
2023-11-07 00:00:00
Oracle Linux 9 : pcs / (LOW) (ELSA-2023-6316)
2023-11-16 00:00:00
fedora
fedora
[SECURITY] Fedora 37 Update: pcs-0.11.6-1.fc37
2023-07-01 00:38:09
[SECURITY] Fedora 38 Update: pcs-0.11.6-1.fc38
2023-07-01 01:46:23
[SECURITY] Fedora 37 Update: yarnpkg-1.22.19-5.fc37
2023-03-30 01:21:37
redhatcve
redhatcve
CVE-2022-38900
2023-02-16 21:29:43
redhat
redhat
(RHSA-2023:6316) Low: pcs security, bug fix, and enhancement update
2023-11-07 06:01:53
(RHSA-2023:1744) Important: rh-nodejs14-nodejs security, bug fix, and enhancement update
2023-04-12 14:38:13
(RHSA-2023:1743) Important: nodejs:14 security, bug fix, and enhancement update
2023-04-12 14:37:46
almalinux
almalinux
Low: pcs security, bug fix, and enhancement update
2023-11-07 00:00:00
Important: nodejs:14 security, bug fix, and enhancement update
2023-04-12 00:00:00
oraclelinux
oraclelinux
pcs
2023-11-12 00:00:00
nodejs:14 security, bug fix, and enhancement update
2023-04-12 00:00:00
openvas
openvas
Fedora: Security Advisory for pcs (FEDORA-2023-b86fd9ad80)
2023-07-02 00:00:00
Fedora: Security Advisory for pcs (FEDORA-2023-ae96dd6105)
2023-07-02 00:00:00
Elastic Kibana 7.0.0 < 7.17.9, 8.0.0 < 8.6.1 DoS Vulnerability (ESA-2023-02)
2023-02-06 00:00:00
osv
osv
CVE-2022-38900
2022-11-28 13:15:10
Low: pcs security, bug fix, and enhancement update
2023-11-07 00:00:00
decode-uri-component vulnerable to Denial of Service (DoS)
2022-11-28 15:30:24
ibm
ibm
Security Bulletin: Vulnerability in nodejs decode-uri-component affect Cloud Pak System[CVE-2022-38900]
2024-01-03 18:17:39
Security Bulletin: IBM Watson Discovery Cartridge for IBM Cloud Pak for Data affected by vulnerability in Node.js decode-uri-component
2023-01-30 17:47:56
Security Bulletin: IBM App Connect Enterprise Certified Container operands may be vulnerable to denial of service due to [CVE-2022-38900]
2023-04-28 11:44:02
cve
cve
CVE-2022-38900
2022-11-28 13:15:00
CVE-2022-38778
2023-02-08 21:15:10
prion
prion
Input validation
2022-11-28 13:15:00
Design/Logic Flaw
2023-02-08 21:15:00
github
github
decode-uri-component vulnerable to Denial of Service (DoS)
2022-11-28 15:30:24
rocky
rocky
nodejs:14 security, bug fix, and enhancement update
2023-04-26 15:28:13

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

5 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:N/I:N/A:P

0.002 Low

EPSS

Percentile

55.7%

JSON
Related for 878E7A7932F19F58853CFC5A17186F8337CDBC16A9F6A3535F0697F29B91EA5B
veracode1nessus17fedora5redhatcve1redhat8almalinux2oraclelinux2openvas6osv6ibm14cve2prion2github1rocky1