Inclusion of Sensitive Information in Log Files in IBM DB2 - CVE-2022-43930

Vulnerability identifier: #VU72060

CSH Severity: Low

CVSS v4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2022-43930

CWE-ID: CWE-532

Exploitation vector: Local access

Exploit availability: No public exploit available

The vulnerability allows a local user to gain access to sensitive information.

The vulnerability exists due to software stores sensitive information into log files. A local user can read the log files and gain access to sensitive data.

IBM DB2
DB2 Warehouse on Cloud Pak for Data
DB2 on Cloud Pak for Data
Db2 Big SQL
IBM Intelligent Operations Center
IBM Security Verify Governance
IBM Sterling Partner Engagement Manager
IBM Cloud Application Performance Management (APM)
IBM Cloud Pak for Business Automation
Spectrum Protect Server

Install updates from vendor's website.

IBM Intelligent Operations Center - update to 5.2.4
IBM Sterling Partner Engagement Manager - addressed in versions 6.1.2.8, 6.2.0.6, 6.2.1.3, 6.2.2.1
Db2 Big SQL - update to 7.5
IBM Cloud Application Performance Management (APM) - update to 8.1.4.0.4
Spectrum Protect Server - update to 8.1.18
IBM Cloud Pak for Business Automation - addressed in versions 21.0.3.22, 22.0.2.6

• https://www.ibm.com/support/pages/node/6953755

• Multiple vulnerabilities in IBM DB2
• Multiple vulnerabilities in IBM Spectrum Protect Server
• Multiple vulnerabilities in IBM Sterling Partner Engagement Manager
• Multiple vulnerabilities in IBM Cloud Pak for Business Automation
• Multiple vulnerabilities in IBM Db2 on Cloud Pak for Data and Db2 Warehouse on Cloud Pak for Data
• Multiple vulnerabilities in IBM Intelligent Operations Center
• Multiple vulnerabilities in IBM Application Performance Management products
• Multiple vulnerabilities in IBM Security Verify Governance - Identity Manager
• Multiple vulnerabilities in IBM Big SQL