Lucene search

IBMB58273A46585A739CAD11717097DC7D4E8F92D10EFC45A6A4119F610205AA225

HistoryFeb 09, 2023 - 7:05 p.m.

Security Bulletin: IBM Sterling B2B Integrator is vulnerable to improper permission controls (CVE-2022-40232)

2023-02-0919:05:52

www.ibm.com

ibm sterling b2b integrator

cve-2022-40232

vulnerability fix

permission controls

improper

version 6.1.0.0 - 6.1.1.1

6.1.2.0

it41648

apply 6.1.1.2

6.1.2.1

ibm entitled registry

8.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

0.001 Low

EPSS

Percentile

36.6%

JSON

Summary

IBM Sterling B2B Integrator has addressed the permission control security vulnerability

Vulnerability Details

CVEID:CVE-2022-40232
**DESCRIPTION:**IBM Sterling B2B Integrator Standard Edition could allow an authenticated user to perform actions they should not have access to due to improper permission controls.
CVSS Base score: 6.3
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/235597 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L)

Affected Products and Versions

Affected Product(s)	Version(s)
IBM Sterling B2B Integrator	6.1.0.0 - 6.1.1.1, 6.1.2.0

Remediation/Fixes

Product	Version	APAR	Remediation & Fix
IBM Sterling B2B Integrator	6.1.0.0 - 6.1.1.1, 6.1.2.0	IT41648	Apply 6.1.1.2 or 6.1.2.1

The IIM versions of 6.1.1.2 and 6.1.2.1 are available on Fix Central.

The container version of 6.1.2.1 is available in IBM Entitled Registry with following tags.

cp.icr.io/cp/ibm-b2bi/b2bi:6.1.2.1 for IBM Sterling B2B Integrator
cp.icr.io/cp/ibm-sfg/sfg:6.1.2.1 for IBM Sterling File Gateway

Workarounds and Mitigations

None

Affected configurations

Vulners

Node

ibmsterling_b2b_integratorMatch6.0.0.0

ibmsterling_b2b_integratorMatch6.1.2.1

CPENameOperatorVersion
ibm sterling b2b integratoreq6.0.0.0
ibm sterling b2b integratoreq6.1.2.1

CPE	Name	Operator	Version
	ibm sterling b2b integrator	eq	6.0.0.0
	ibm sterling b2b integrator	eq	6.1.2.1

8.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

0.001 Low

EPSS

Percentile

36.6%

JSON

Related for B58273A46585A739CAD11717097DC7D4E8F92D10EFC45A6A4119F610205AA225