Lucene search

K
ibmIBMEBFFCC00EDD65F45E051073EAF518CD443503E46CC247513E4B973ECC7C31531
HistoryJul 28, 2022 - 7:47 p.m.

Security Bulletin: Sterling Order Management and Spring vulnerability CVE-2022-22963

2022-07-2819:47:33
www.ibm.com
19

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

7.5 High

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

0.975 High

EPSS

Percentile

100.0%

Abstract

Is Sterling Order Management affected by Spring vulnerability CVE-2022-22963?

Content

IBM is aware of a recently surfaced vulnerability CVE-2022-22963 and has evaluated whether any Sterling Order Management applications are affected. The following is a summary of our evaluation:

Component |

Spring
version

used

| Impacted by
CVE-2022-22963 |

Immediate

Mitigation

Plan

| Latest Status
β€”|β€”|β€”|β€”|β€”
Sterling Order Management SaaS, On-prem and Certified Containers (including Store Engagement & Call Center) | Not used | No | N/A | Not vulnerable

Inventory Visibility

Microservice

| Not used | No | N/A | Not vulnerable

Intelligent Promising

Microservice

| Not used | No | N/A | Not vulnerable
OMS Data Exchange Service | Not used | No | N/A | Not vulnerable

Store Inventory Management

Microservice

| Not used | No | N/A | Not vulnerable
Order Hub | Not used | No | N/A | Not vulnerable
Sterling Fulfillment Optimizer | Not used | No | N/A | Not vulnerable
Configure, Price, Quote (CPQ): Omni-Configurator and Visual Modeler | Not used | No | N/A | Not vulnerable
Configure, Price, Quote (CPQ): Field Sales | Not used | No | N/A | Not vulnerable

Related Information

CVE-2022-22963 - National Vulnerability Database

CVE-2022-22963 - mitre.org

CVE-2022-22963: Spring Framework RCE via Data Binding on JDK 9+ - vmware.com

[{β€œType”:β€œMASTER”,β€œLine of Business”:{β€œcode”:β€œLOB59”,β€œlabel”:β€œSustainability Software”},β€œBusiness Unit”:{β€œcode”:β€œBU059”,β€œlabel”:β€œIBM Software w/o TPS”},β€œProduct”:{β€œcode”:β€œSS6PEW”,β€œlabel”:β€œSterling Order Management”},β€œARM Category”:[{β€œcode”:β€œa8m0z000000cy00AAA”,β€œlabel”:β€œOrders”}],β€œPlatform”:[{β€œcode”:β€œPF025”,β€œlabel”:β€œPlatform Independent”}],β€œVersion”:β€œAll Versions”}]

CPENameOperatorVersion
sterling order managementeqany

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

7.5 High

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

0.975 High

EPSS

Percentile

100.0%