Information disclosure in IBM WebSphere Application Server - CVE-2022-22473

Vulnerability identifier: #VU72144

CSH Severity: Medium

CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2022-22473

CWE-ID: CWE-200

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists due to improper handling of Administrative Console data. A remote attacker can gain unauthorized access to sensitive information on the system.

IBM WebSphere Application Server
Content Collector for Email
IBM Tivoli Monitoring
IBM Security Directory Server
IBM Security Directory Suite

Install updates from vendor's website.

IBM WebSphere Application Server - addressed in versions 7.0.0.45 PH46342, 8.0.0.15 PH46342, 8.5.5.22, 9.0.5.13
Content Collector for Email - update to 4.0.1.9 IF014
IBM Tivoli Monitoring - update to 6.3.0.7 Plus Service Pack 5
IBM Security Directory Server - update to 6.4.0.27
IBM Security Directory Suite - update to 8.0.1.19

• https://exchange.xforce.ibmcloud.com/vulnerabilities/225347
• https://www.ibm.com/support/pages/node/6603421

• Multiple vulnerabilities in IBM Tivoli Monitoring
• Multiple vulnerabilities in IBM Directory Server and IBM Directory Suite
• Information disclosure in IBM Content Collector for Email