9.8

CVE-2022-22318

IBM Curam Social Program Management 8.0.0 and 8.0.1 does not invalidate session after logout which could allow an authenticated user to impersonate another user on the system.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Ibm ≫ Curam Social Program Management Version 8.0.0
   Hp ≫ Hp-ux Version -
   Ibm ≫ Aix Version -
   Ibm ≫ Z/os Version -
   Linux ≫ Linux Kernel Version -
   Microsoft ≫ Windows Version -
   Oracle ≫ Solaris Version - HwPlatform -
Ibm ≫ Curam Social Program Management Version 8.0.1
   Hp ≫ Hp-ux Version -
   Ibm ≫ Aix Version -
   Ibm ≫ Z/os Version -
   Linux ≫ Linux Kernel Version -
   Microsoft ≫ Windows Version -
   Oracle ≫ Solaris Version - HwPlatform -
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.43% 0.355
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 9.8 3.9 5.9
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NIST 6.5 8 6.4
AV:N/AC:L/Au:S/C:P/I:P/A:P
IBM 5.9 2.5 3.4
CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
CWE-613 Insufficient Session Expiration

According to WASC, "Insufficient Session Expiration is when a web site permits an attacker to reuse old session credentials or session IDs for authorization."

https://www.ibm.com/support/pages/node/6596049
Patch
Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/218283
Vendor Advisory
VDB Entry