Cross-site request forgery in IBM DataPower Gateway - CVE-2022-31773
Published: August 30, 2022 / Updated: November 21, 2022
Vulnerability identifier: #VU66858
CSH Severity: Medium
CVSS v4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2022-31773
CWE-ID: CWE-352
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to perform cross-site request forgery attacks.
The vulnerability exists due to insufficient validation of the HTTP request origin. A remote attacker can trick the victim to visit a specially crafted web page and execute malicious and unauthorized actions transmitted from a user that the website trusts.
Affected software
IBM DataPower Gateway
IBM MQ Appliance
IBM MQ Appliance
How to mitigate CVE-2022-31773
Install update from vendor's website.
IBM DataPower Gateway - addressed in versions 10.0.1.10, 10.0.4.0sr2, 2018.4.1.23
IBM MQ Appliance - addressed in versions 9.2.0.7, 9.2.5.4
IBM MQ Appliance - addressed in versions 9.2.0.7, 9.2.5.4