Risk | Medium |
Patch available | YES |
Number of vulnerabilities | 1 |
CVE-ID | CVE-2022-43917 |
CWE-ID | CWE-326 |
Exploitation vector | Network |
Public exploit | N/A |
Vulnerable software Subscribe |
IBM WebSphere Application Server Server applications / Application servers |
Vendor | IBM Corporation |
Security Bulletin
This security bulletin contains one medium risk vulnerability.
EUVDB-ID: #VU71483
Risk: Medium
CVSSv3.1: 5.2 [CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C]
CVE-ID: CVE-2022-43917
CWE-ID:
CWE-326 - Inadequate Encryption Strength
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to gain access to sensitive information.
The vulnerability exists due to the IBM WebSphere Application Server traditional container uses
weaker than expected cryptographic keys that could allow an attacker to
decrypt sensitive information.A remote attacker can gain access to sensitive information.
Note, this affects only the containerized version of WebSphere Application Server traditional.
MitigationInstall updates from vendor's website.
Vulnerable software versionsIBM WebSphere Application Server: 8.5.5.17 - 9.0.5.14
External linkshttp://www.ibm.com/support/pages/node/6857007
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.