Main Vulnerability Database Vulnerabilities #VU65558

Server-Side Request Forgery (SSRF) in IBM Sterling Partner Engagement Manager - CVE-2022-22416

Published: July 20, 2022

Vulnerability identifier: #VU65558

CSH Severity: Low

CVSS v4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2022-22416

CWE-ID: CWE-918

Exploitation vector: Remote access

Exploit availability: No public exploit available

Vulnerability details

The disclosed vulnerability allows a remote user to perform SSRF attacks.

The vulnerability exists due to insufficient validation of user-supplied input. A remote user can send a specially crafted HTTP request and trick the application to initiate requests to arbitrary systems.

Successful exploitation of this vulnerability may allow a remote attacker gain access to sensitive data, located in the local network or send malicious requests to other servers from the vulnerable system.

Affected software

IBM Sterling Partner Engagement Manager
IBM Sterling Partner Engagement Manager on Cloud / SaaS

How to mitigate CVE-2022-22416

Install updates from vendor's website.

IBM Sterling Partner Engagement Manager - addressed in versions 6.1.2.5, 6.2.0.3
IBM Sterling Partner Engagement Manager on Cloud / SaaS - update to 22.2.1

External References

Related Security Bulletins