Improper Privilege Management in IBM DB2 - CVE-2022-43927

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU72059

Improper Privilege Management in IBM DB2 - CVE-2022-43927

Published: February 8, 2023


Vulnerability identifier: #VU72059
CSH Severity: Low
CVSS v4: 4.8 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2022-43927
CWE-ID: CWE-269
Exploitation vector: Remote access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote user to gain access to sensitive information.

The vulnerability exists due to improper privilege management when a specially crafted table access is used.. A remote user can gain access to sensitive information.


Affected software

IBM DB2
DB2 Warehouse on Cloud Pak for Data
DB2 on Cloud Pak for Data
Db2 Big SQL
IBM Intelligent Operations Center
IBM Security Verify Governance
IBM Sterling Partner Engagement Manager
IBM Cloud Application Performance Management (APM)
IBM Cloud Pak for Business Automation
IBM Cloud Pak System
Spectrum Protect Server

How to mitigate CVE-2022-43927

Install updates from vendor's website.

IBM Intelligent Operations Center - update to 5.2.4
IBM Cloud Pak System - update to 2.3.3.7 iFix 01
IBM Sterling Partner Engagement Manager - addressed in versions 6.1.2.8, 6.2.0.6, 6.2.1.3, 6.2.2.1
Db2 Big SQL - update to 7.5
IBM Cloud Application Performance Management (APM) - update to 8.1.4.0.4
Spectrum Protect Server - update to 8.1.18
IBM Cloud Pak for Business Automation - addressed in versions 21.0.3.22, 22.0.2.6

External References

Related Security Bulletins