Lucene search
K
Database
Vendors
Products
Years
CVSS
Scanner
Agent Scanning
API Scanning
Manual Audit
Perimeter Scanner
Scanning
Projects
Email
Webhook
Plugins
Resources
Documents
Blog
Glossary
FAQ
Pricing
Contacts
About Us
Partners
Branding Guideline
ibmIBMAC00E4178E37010468F0B24053B2F581EB19F874CFB94B2DD1DB2FA5B2F608E9
HistoryMar 29, 2023 - 1:48 a.m.

Security Bulletin: Vulnerability in Apache Tomcat affects IBM SAN Volume Controller, IBM Storwize, IBM Spectrum Virtualize and IBM FlashSystem products

2023-03-2901:48:02
www.ibm.com
25

8.6 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

LOW

Availability Impact

LOW

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L

7.5 High

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

0.006 Low

EPSS

Percentile

78.3%

JSON

Summary

A vulnerability in Apache Tomcat affects the product’s management GUI. The Command Line Interface is unaffected.

Vulnerability Details

CVEID:CVE-2022-25762
**DESCRIPTION:**Apache Tomcat could allow a remote attacker to bypass security restrictions, caused by improper error handling in WebSocket connection. By sending a specially-crafted WebSocket message concurrently with the WebSocket connection closing, an attacker could exploit this vulnerability to continue to use the socket after it has been closed.
CVSS Base score: 8.6
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/226498 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L)

Affected Products and Versions

Affected Product(s) Version(s)
IBM Spectrum Virtualize 8.4
IBM Spectrum Virtualize 8.5

Note that this applies to all IBM SAN Volume Controller, IBM Storwize and IBM FlashSystem products which run IBM Spectrum Virtualize software.

Remediation/Fixes

IBM recommends that you fix this vulnerability by upgrading affected versions of IBM SAN Volume Controller, IBM Storwize V7000, IBM Storwize V5000 and V5100, IBM Storwize V5000E, IBM Spectrum Virtualize Software, IBM Spectrum Virtualize for Public Cloud, IBM FlashSystem V9000, IBM FlashSystem 9500, IBM FlashSystem 9100 Family, IBM FlashSystem 9200, IBM FlashSystem 7300, IBM FlashSystem 7200, IBM FlashSystem 5200 and IBM FlashSystem 5000 to the following code levels or higher:

8.5.2.0

8.5.0.5

8.4.0.7

Latest IBM SAN Volume Controller Code
Latest IBM Storwize V7000 Code
Latest IBM Storwize V5000 and V5100 Code
Latest IBM Storwize V5000E Code
Latest IBM FlashSystem V9000 Code
Latest IBM FlashSystem 9500 Code
Latest IBM FlashSystem 9100 Family Code
Latest IBM FlashSystem 9200 Code
Latest IBM FlashSystem 7300 Code
Latest IBM FlashSystem 7200 Code
Latest IBM FlashSystem 5000 and 5200 Code
Latest IBM Spectrum Virtualize Software
Latest IBM Spectrum Virtualize for Public Cloud

Workarounds and Mitigations

None

Related

prion 1
nessus 10
osv 4
ibm 6
veracode 1
cnvd 1
github 1
debiancve 1
ubuntucve 1
tomcat 2
cve 1
redhatcve 1
f5 1
amazon 1
rosalinux 1
redhat 1
rocky 1
oracle 1
prion
prion
Code injection
2022-05-13 08:15:00
nessus
nessus
Apache Tomcat 9.0.0.M1 < 9.0.21 vulnerability
2022-05-13 00:00:00
Apache Tomcat 8.5.0 < 8.5.76 vulnerability
2022-05-13 00:00:00
Amazon Linux AMI : tomcat8 (ALAS-2022-1627)
2022-08-05 00:00:00
osv
osv
Improper socket reuse in Apache Tomcat
2022-05-14 00:01:50
CVE-2022-25762
2022-05-13 08:15:06
BIT-tomcat-2022-25762
2024-03-06 11:09:31
ibm
ibm
Security Bulletin: IBM UrbanCode Release is vulnerable to a bypass of security restrictions due to use of Apache Tomcat (CVE-2022-25762).
2022-07-18 15:23:29
Security Bulletin: IBM UrbanCode Build is vulnerable to a bypass of security restrictions due to use of Apache Tomcat (CVE-2022-25762).
2022-07-18 15:29:10
Security Bulletin: Vulnerabilities in Apache Tomcat, Apache Commons FileUpload and Apache Axis might affect IBM Storage Copy Data Management
2024-03-22 16:05:48
veracode
veracode
Command Injection
2022-09-05 19:23:03
cnvd
cnvd
Apache Tomcat Request Obfuscation Vulnerability
2022-05-17 00:00:00
github
github
Improper socket reuse in Apache Tomcat
2022-05-14 00:01:50
debiancve
debiancve
CVE-2022-25762
2022-05-13 08:15:00
ubuntucve
ubuntucve
CVE-2022-25762
2022-05-13 00:00:00
tomcat
tomcat
Fixed in Apache Tomcat 8.5.76
2022-02-28 00:00:00
Fixed in Apache Tomcat 9.0.21
2019-06-07 00:00:00
cve
cve
CVE-2022-25762
2022-05-13 08:15:00
redhatcve
redhatcve
CVE-2022-25762
2022-05-13 00:41:04
f5
f5
K49622415 : Apache Tomcat vulnerability CVE-2022-25762
2022-07-07 00:00:00
amazon
amazon
Important: tomcat8
2022-07-28 20:39:00
rosalinux
rosalinux
Advisory ROSA-SA-2023-2258
2023-10-21 16:49:43
redhat
redhat
(RHSA-2020:4847) Moderate: pki-core:10.6 and pki-deps:10.6 security, bug fix, and enhancement update
2020-11-03 12:29:58
rocky
rocky
pki-core:10.6 and pki-deps:10.6 security, bug fix, and enhancement update
2020-11-03 12:29:58
oracle
oracle
Oracle Critical Patch Update Advisory - July 2022
2022-07-19 00:00:00

8.6 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

LOW

Availability Impact

LOW

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L

7.5 High

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

0.006 Low

EPSS

Percentile

78.3%

JSON
Related for AC00E4178E37010468F0B24053B2F581EB19F874CFB94B2DD1DB2FA5B2F608E9
prion1nessus10osv4ibm6veracode1cnvd1github1debiancve1ubuntucve1tomcat2cve1redhatcve1f51amazon1rosalinux1redhat1rocky1oracle1