Lucene search
K
Database
Vendors
Products
Years
CVSS
Scanner
Agent Scanning
API Scanning
Manual Audit
Perimeter Scanner
Scanning
Projects
Email
Webhook
Plugins
Resources
Documents
Blog
Glossary
FAQ
Pricing
Contacts
About Us
Partners
Branding Guideline
ibmIBMF9131F02C1CCBB4B3EA7DA908C1A89AE7A0507CAA07776F4F8159AD3EABD9903
HistoryNov 16, 2022 - 9:26 p.m.

Security Bulletin: IBM Partner Engagement Manager is vulnerable to sensitive data exposure (CVE-2022-34354)

2022-11-1621:26:28
www.ibm.com
19
ibm sterling partner engagement manager
local data exposure
vulnerability
fixed versions

4 Medium

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

0.0004 Low

EPSS

Percentile

12.6%

JSON

Summary

IBM Sterling Partner Engagement Manager has addressed a client HTML5 vulnerability that allows encrypted storage of client data to be stored locally which can be read by another user on the system.

Vulnerability Details

CVEID:CVE-2022-34354
**DESCRIPTION:**IBM Sterling Partner Engagement Manager allows encrypted storage of client data to be stored locally which can be read by another user on the system.
CVSS Base score: 4
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/230424 for the current score.
CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)

Affected Products and Versions

Affected Product(s) Version(s)
Partner Engagement Manager 6.1.2, 6.2.0, 6.2.1

Remediation/Fixes

Product Version Remediation
IBM Sterling Partner Engagement Manager Essentials Edition 6.1.2.6 http://www.ibm.com/support/fixcentral/quickorder?product=ibm%2FOther+software%2FIBM+Sterling+Partner+Engagement+Manager+Software&fixids=IBM_PEM_Essentials_6.1.2.6&source=SAR
IBM Sterling Partner Engagement Manager Standard Edition 6.1.2.6 http://www.ibm.com/support/fixcentral/quickorder?product=ibm%2FOther+software%2FIBM+Sterling+Partner+Engagement+Manager+Software&fixids=IBM_PEM_Standard_6.1.2.6&source=SAR
IBM Sterling Partner Engagement Manager Essentials Edition 6.2.0.4 http://www.ibm.com/support/fixcentral/quickorder?product=ibm%2FOther+software%2FIBM+Sterling+Partner+Engagement+Manager+Software&fixids=IBM_PEM_Essentials_6.2.0.4&source=SAR
IBM Sterling Partner Engagement Manager Standard Edition 6.2.0.4 http://www.ibm.com/support/fixcentral/quickorder?product=ibm%2FOther+software%2FIBM+Sterling+Partner+Engagement+Manager+Software&fixids=IBM_PEM_Standard_6.2.0.4&source=SAR
IBM Sterling Partner Engagement Manager Essentials Edition 6.2.1.1 http://www.ibm.com/support/fixcentral/quickorder?product=ibm%2FOther+software%2FIBM+Sterling+Partner+Engagement+Manager+Software&fixids=IBM_PEM_Essentials_6.2.1.1&source=SAR
IBM Sterling Partner Engagement Manager Standard Edition 6.2.1.1 https://www.ibm.com/support/fixcentral/swg/selectFixes?product=ibm%2FOther+software%2FIBM+Sterling+Partner+Engagement+Manager+Software&fixids=IBM_PEM_Standard_6.2.1.1&source=SAR

Workarounds and Mitigations

None

Affected configurations

Vulners
Node
ibmpartner_engagement_managerMatch6.1
CPENameOperatorVersion
partner engagement managereq6.1

Related

cnvd 1
cvelist 1
prion 1
nvd 1
cve 1
cnvd
cnvd
IBM Sterling Partner Engagement Manager Information Disclosure Vulnerability (CNVD-2022-85417)
2022-11-18 00:00:00
cvelist
cvelist
CVE-2022-34354 IBM Sterling Partner Engagement Manager information disclosure
2022-11-16 16:25:44
prion
prion
Code injection
2022-11-16 17:15:00
nvd
nvd
CVE-2022-34354
2022-11-16 17:15:10
cve
cve
CVE-2022-34354
2022-11-16 17:15:10

4 Medium

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

0.0004 Low

EPSS

Percentile

12.6%

JSON
Related for F9131F02C1CCBB4B3EA7DA908C1A89AE7A0507CAA07776F4F8159AD3EABD9903
cnvd1cvelist1prion1nvd1cve1