SB2022092661 - IBM Sterling Partner Engagement Manager update for Apache Shiro

Description

This security bulletin contains information about 2 secuirty vulnerabilities.

1) Improper Authentication (CVE-ID: CVE-2022-32532)

The vulnerability allows a remote attacker to bypass authentication process.

The vulnerability exists due to an error in RegexRequestMatcher configuration. A remote attacker can bypass authentication process and gain unauthorized access to the application. Applications using RegExPatternMatcher with `.` in the regular expression are affected by the vulnerability.

2) Input validation error (CVE-ID: CVE-2022-22970)

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to insufficient validation of user-supplied input within the Spring MVC or Spring WebFlux applications. A remote user can pass specially crafted input to the application and perform a denial of service (DoS) attack.

Remediation

Install update from vendor's website.

References

• https://www.ibm.com/blogs/psirt/security-bulletin-ibm-sterling-partner-engagement-manager-vulnerable-to-denial-of-service-due-to-apache-shiro-cve-2022-32532/"
• https://www.ibm.com/blogs/psirt/security-bulletin-ibm-sterling-partner-engagement-manager-vulnerable-to-denial-of-service-due-to-apache-shiro-cve-2022-32532/</a></p><p>
• https://www.ibm.com/support/pages/node/6734315</p><p><br></p>