IBMD60E6BA4F6489F1D1F13EB279E6C70998E2F8B1E11393639432A7166F8889E62Security Bulletin: IBM Sterling Partner Engagement Manager is vulnerable to a denial of service due to SnakeYAML (CVE-2022-38752)
6.5 Medium
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
6.7 Medium
AI Score
Confidence
High
4 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
LOW
Authentication
SINGLE
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
PARTIAL
AV:N/AC:L/Au:S/C:N/I:N/A:P
0.003 Low
EPSS
Percentile
71.4%
Summary
IBM Sterling Partner Engagement Manager uses SnakeYAML.
Vulnerability Details
CVEID:CVE-2022-38752
**DESCRIPTION:**SnakeYAML is vulnerable to a denial of service, caused by a stack-overflow in parsing YAML files. By persuading a victim to open a specially crafted file, a remote attacker could exploit this vulnerability to cause the application to crash.
CVSS Base score: 5.3
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/235310 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)
Affected Products and Versions
| Affected Product(s) | Version(s) |
|---|---|
| IBM Sterling Partner Engagement Manager | 6.2.2 |
| IBM Sterling Partner Engagement Manager | 6.1.2 |
| IBM Sterling Partner Engagement Manager | 6.2.0 |
Remediation/Fixes
IBM strongly recommends addressing the vulnerability now by upgrading …
| Product | Version(s) | Remediation |
|---|---|---|
| IBM Sterling Partner Engagement Manager Essentials Edition | 6.2.2.2 | IBM Support: Fix Central - Download files using HTTPS |
| IBM Sterling Partner Engagement Manager Standard Edition | 6.2.2.2 | IBM Support: Fix Central - Download files using HTTPS |
| IBM Sterling Partner Engagement Manager Essentials Edition | 6.1.2.9 | IBM Support: Fix Central - Download files using HTTPS |
| IBM Sterling Partner Engagement Manager Standard Edition | 6.1.2.9 | IBM Support: Fix Central - Download files using HTTPS |
| IBM Sterling Partner Engagement Manager Essentials Edition | 6.2.0.7 | IBM Support: Fix Central - Download files using HTTPS |
| IBM Sterling Partner Engagement Manager Standard Edition | 6.2.0.7 | IBM Support: Fix Central - Download files using HTTPS |
Workarounds and Mitigations
None
Related
6.5 Medium
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
6.7 Medium
AI Score
Confidence
High
4 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
LOW
Authentication
SINGLE
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
PARTIAL
AV:N/AC:L/Au:S/C:N/I:N/A:P
0.003 Low
EPSS
Percentile
71.4%