Lucene search

IBM9FCAE2AB5006957F6F4A2E77AFEBB31213D1E38FC59E3883AA0908F2645059C4

HistoryMar 31, 2023 - 10:35 p.m.

Security Bulletin: Trusteer SDK for Mobile vulnerable to file upload (CVE-2022-42443)

2023-03-3122:35:52

www.ibm.com

trusteer

mobile sdk

vulnerability

rebuild

latest version

ios

android

security improvement

file upload

2.2 Low

CVSS3

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

HIGH

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:N

0.0004 Low

EPSS

Percentile

9.1%

JSON

Summary

Security improvements were made to the Trusteer Mobile SDKs for iOS and Android. No code changes are required to take advantage of the improvements, but mobile application creators must rebuild using the latest SDK version and redeploy their mobile apps to take advantage of these improvements.

Vulnerability Details

CVEID:CVE-2022-42443
**DESCRIPTION:**An undisclosed issue in Trusteer agents may allow uploading of files.
CVSS Base score: 2.2
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/238535 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:N)

Affected Products and Versions

Affected Product(s)	Version(s)
Trusteer iOS SDK for mobile	All prior to 5.7
Trusteer Android SDK for mobile	All prior to 5.7

Remediation/Fixes

IBM encourages customers to rebuild their mobile applications with the latest SDK promptly.

Affected Product(s)	Fixed Version	Fix
Trusteer iOS SDK for mobile	5.7 and later	To download the latest version of Trusteer Mobile SDK, go to the customer portal. The URL is: <https://trusteersupport.force.com/>
Trusteer Android SDK for mobile	5.7 and later	To download the latest version of Trusteer Mobile SDK, go to the customer portal. The URL is: <https://trusteersupport.force.com/>

Workarounds and Mitigations

None

Affected configurations

Vulners

Node

ibmsecurity_trusteer_pinpoint_detectMatch5.7

CPENameOperatorVersion
ibm security trusteer mobile sdkeq5.7

CPE	Name	Operator	Version
	ibm security trusteer mobile sdk	eq	5.7

2.2 Low

CVSS3

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

HIGH

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:N

0.0004 Low

EPSS

Percentile

9.1%

JSON

Related for 9FCAE2AB5006957F6F4A2E77AFEBB31213D1E38FC59E3883AA0908F2645059C4