CVE-2022-40230

EPSS 0.06%
Published 03.11.2022 20:15:31
Last modified 02.05.2025 21:15:18
Source psirt@us.ibm.com
Teams watchlist Login
Open Login

"IBM MQ Appliance 9.2 CD, 9.2 LTS, 9.3 CD, and LTS 9.3 does not invalidate session after logout which could allow an authenticated user to impersonate another user on the system. IBM X-Force ID: 235532."

Affected products Warnungen 0 Metrics 3 CWE 1 References 4

Data is provided by the National Vulnerability Database (NVD)

Ibm ≫ Mq Appliance Version9.2.0.0 SwEditioncontinuous_delivery

Ibm ≫ Mq Appliance Version9.2.0.0 SwEditionlts

Ibm ≫ Mq Appliance Version9.3.0.0 SwEditioncontinuous_delivery

Ibm ≫ Mq Appliance Version9.3.0.0 SwEditionlts

Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.

EPSS Metriken
Type	Source	Score	Percentile
EPSS	FIRST.org	0.06%	0.202

CVSS Metriken
Source	Base Score	Exploit Score	Impact Score	Vector string
nvd@nist.gov	6.5	2.8	3.6	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
134c704f-9b21-4f2e-91b3-4a467353bcc0	6.5	2.8	3.6	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

CWE-613 Insufficient Session Expiration

According to WASC, "Insufficient Session Expiration is when a web site permits an attacker to reuse old session credentials or session IDs for authorization."

https://www.ibm.com/support/pages/node/6622051

Patch

Vendor Advisory

https://nvd.nist.gov/vuln/detail/CVE-2022-40230

CVE Source (NVD)

https://cveawg.mitre.org/api/cve/CVE-2022-40230

CVE Source (JSON)

https://euvd.enisa.europa.eu/vulnerability/CVE-2022-40230

EUVD