Multiple vulnerabilities in IBM Directory Server and IBM Directory Suite
| Risk | Medium |
| Patch available | YES |
| Number of vulnerabilities | 4 |
| CVE-ID | CVE-2022-21496 CVE-2021-35550 CVE-2021-2163 CVE-2021-35603 |
| CWE-ID | CWE-20 CWE-300 |
| Exploitation vector | Network |
| Public exploit | N/A |
| Vulnerable software |
IBM Security Directory Suite Other software / Other software solutions IBM Security Directory Server Other software / Other software solutions |
| Vendor | IBM Corporation |
Security Bulletin
This security bulletin contains information about 4 vulnerabilities.
1) Improper input validation
EUVDB-ID: #VU62400
Risk: Medium
CVSSv3.1: 4.6 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N/E:U/RL:O/RC:C]
CVE-ID: CVE-2022-21496
CWE-ID:
CWE-20 - Improper input validation
Exploit availability: No
DescriptionThe vulnerability allows a remote non-authenticated attacker to manipulate data.
The vulnerability exists due to improper input validation within the JNDI component in Oracle GraalVM Enterprise Edition. A remote non-authenticated attacker can exploit this vulnerability to manipulate data.
MitigationInstall update from vendor's website.
Vulnerable software versionsIBM Security Directory Suite: before 8.0.1.19
IBM Security Directory Server: before 6.4.0.27
CPE2.3- cpe:2.3:a:ibm_corporation:ibm_security_directory_suite:*:*:*:*:*:*:*:
- cpe:2.3:a:ibm_corporation:ibm_security_directory_server:*:*:*:*:*:*:*:
http://www.ibm.com/support/pages/node/6997585
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
2) Man-in-the-Middle (MitM) attack
EUVDB-ID: #VU57487
Risk: Medium
CVSSv3.1: 4.2 [CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N/E:U/RL:O/RC:C]
CVE-ID: CVE-2021-35550
CWE-ID:
CWE-300 - Channel Accessible by Non-Endpoint ('Man-in-the-Middle')
Exploit availability: No
DescriptionThe vulnerability allows a remote non-authenticated attacker to gain access to sensitive information.
The vulnerability exists due to the JSSE component in Oracle GraalVM Enterprise Edition offers cipher suites in the wrong way, which causes weaker cipher suites to be offered ahead of the strong ones. A remote non-authenticated attacker can exploit this vulnerability to gain access to sensitive information.
MitigationInstall update from vendor's website.
Vulnerable software versionsIBM Security Directory Suite: before 8.0.1.19
IBM Security Directory Server: before 6.4.0.27
CPE2.3- cpe:2.3:a:ibm_corporation:ibm_security_directory_suite:*:*:*:*:*:*:*:
- cpe:2.3:a:ibm_corporation:ibm_security_directory_server:*:*:*:*:*:*:*:
http://www.ibm.com/support/pages/node/6997585
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
3) Improper input validation
EUVDB-ID: #VU52449
Risk: Medium
CVSSv3.1: 4.6 [CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N/E:U/RL:O/RC:C]
CVE-ID: CVE-2021-2163
CWE-ID:
CWE-20 - Improper input validation
Exploit availability: No
DescriptionThe vulnerability allows a remote non-authenticated attacker to manipulate data.
The vulnerability exists due to improper input validation within the Libraries component in Oracle GraalVM Enterprise Edition. A remote non-authenticated attacker can exploit this vulnerability to manipulate data.
MitigationInstall update from vendor's website.
Vulnerable software versionsIBM Security Directory Suite: before 8.0.1.19
IBM Security Directory Server: before 6.4.0.27
CPE2.3- cpe:2.3:a:ibm_corporation:ibm_security_directory_suite:*:*:*:*:*:*:*:
- cpe:2.3:a:ibm_corporation:ibm_security_directory_server:*:*:*:*:*:*:*:
http://www.ibm.com/support/pages/node/6997585
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
4) Improper input validation
EUVDB-ID: #VU57496
Risk: Low
CVSSv3.1: 3.2 [CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N/E:U/RL:O/RC:C]
CVE-ID: CVE-2021-35603
CWE-ID:
CWE-20 - Improper input validation
Exploit availability: No
DescriptionThe vulnerability allows a remote non-authenticated attacker to gain access to sensitive information.
The vulnerability exists due to improper input validation within the JSSE component in Oracle GraalVM Enterprise Edition. A remote non-authenticated attacker can exploit this vulnerability to gain access to sensitive information.
MitigationInstall update from vendor's website.
Vulnerable software versionsIBM Security Directory Suite: before 8.0.1.19
IBM Security Directory Server: before 6.4.0.27
CPE2.3- cpe:2.3:a:ibm_corporation:ibm_security_directory_suite:*:*:*:*:*:*:*:
- cpe:2.3:a:ibm_corporation:ibm_security_directory_server:*:*:*:*:*:*:*:
http://www.ibm.com/support/pages/node/6997585
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
