Authorization bypass through user-controlled key in url-parse - CVE-2022-0639

Vulnerability identifier: #VU67253

CSH Severity: Medium

CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2022-0639

CWE-ID: CWE-639

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to gain unauthorized access to otherwise restricted functionality.

The vulnerability exists due to improper access restrictions. A remote attacker can bypass implemented security restrictions and gain unauthorized access to the application.

url-parse
Migration Toolkit for Containers
IBM Watson Machine Learning Accelerator
IBM Planning Analytics Workspace
Ubuntu
node-url-parse (Ubuntu package)
IBM Cloud Pak System

Install updates from vendor's website.

url-parse - update to 1.5.7
Migration Toolkit for Containers - update to 1.7.4
node-url-parse (Ubuntu package) - addressed in versions Ubuntu Pro, 1.2.0-1ubuntu0.1, 1.4.7-3ubuntu0.1
IBM Planning Analytics Workspace - update to 2.0.93
IBM Cloud Pak System - update to 2.3.3.5

• https://github.com/unshiftio/url-parse/commit/ef45a1355375a8244063793a19059b4f62fc8788
• https://huntr.dev/bounties/83a6bc9a-b542-4a38-82cd-d995a1481155

• Improper access control in url-parse
• Multiple vulnerabilities in Migration Toolkit for Containers (MTC) 1.7
• Ubuntu update for node-url-parse
• Multiple vulnerabilities in IBM Watson Machine Learning Accelerator on Cloud Pak for Data
• Multiple vulnerabilities in IBM Planning Analytics Workspace
• Multiple vulnerabilities in IBM Cloud Pak System