SB2025041631 - Permissions, privileges, and access controls in IBM App Connect Enterprise Certified Container
Published: April 16, 2025
Security Bulletin ID
SB2025041631
CSH Severity
Medium
Patch available
YES
Number of vulnerabilities
1
Exploitation vector
Remote access
Highest impact
Data manipulation
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 1 vulnerability.
1) Permissions, Privileges, and Access Controls (CVE-ID: CVE-2022-43916)
CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls
CVSSv4: CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/U:Green
The vulnerability allows a remote user to escalate privileges on the system.
The vulnerability exists due to IBM App Connect Enterprise Certified Container Pods does not restrict network egress for Pods that are used for internal infrastructure. A remote user can bypass security restrictions and escalate privileges on the system.
Remediation
Install update from vendor's website.