Information disclosure in IBM Security Verify Bridge for Directory Sync - CVE-2022-32751

Vulnerability identifier: #VU88406

CSH Severity: Medium

CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2022-32751

CWE-ID: CWE-200

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists due to excessive data output by the application. A remote attacker can gain unauthorized access to sensitive information on the system.

IBM Security Verify Bridge for Directory Sync
IBM Security Directory Server
Security Directory Integrator
IBM Security Directory Suite

Install updates from vendor's website.

IBM Security Verify Bridge for Directory Sync - update to 10.0.1.0
IBM Security Directory Server - update to 6.4.0.28
Security Directory Integrator - addressed in versions 7.2.0.9, 10.0.0.1
IBM Security Directory Suite - update to 8.0.1.21

• https://www.ibm.com/support/pages/node/7145001
• https://exchange.xforce.ibmcloud.com/vulnerabilities/228437

• Information disclosure in IBM Security Verify Directory
• Multiple vulnerabilities in IBM Security Directory Suite
• Information disclosure in Security Directory Integrator