Open redirect in forge - CVE-2022-0122
Published: May 16, 2023
Vulnerability identifier: #VU76186
CSH Severity: Low
CVSS v4: 2.1 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2022-0122
CWE-ID: CWE-601
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to redirect victims to arbitrary URL.
The vulnerability exists due to improper sanitization of user-supplied data. A remote attacker can create a link that leads to a trusted website, however, when clicked, redirects the victim to arbitrary domain.
Successful exploitation of this vulnerability may allow a remote attacker to perform a phishing attack and steal potentially sensitive information.
Affected software
forge
IBM Cloud Automation Manager
IBM Edge Application Manager
Cloud Pak for Multicloud Management Infrastructure Management
IBM Cloud Automation Manager
IBM Edge Application Manager
Cloud Pak for Multicloud Management Infrastructure Management
How to mitigate CVE-2022-0122
Install updates from vendor's website.
forge - update to 1.0.0
Cloud Pak for Multicloud Management Infrastructure Management - update to 2.3 Fix Pack 5
Cloud Pak for Multicloud Management Infrastructure Management - update to 2.3 Fix Pack 5