Inadequate Encryption Strength in IBM WebSphere Application Server - CVE-2022-43917
Published: January 24, 2023
Vulnerability identifier: #VU71483
CSH Severity: Medium
CVSS v4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2022-43917
CWE-ID: CWE-326
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to gain access to sensitive information.
The vulnerability exists due to the IBM WebSphere Application Server traditional container uses
weaker than expected cryptographic keys that could allow an attacker to
decrypt sensitive information.A remote attacker can gain access to sensitive information.
Note, this affects only the containerized version of WebSphere Application Server traditional.
Affected software
IBM WebSphere Application Server
How to mitigate CVE-2022-43917
Install updates from vendor's website.