Use of a broken or risky cryptographic algorithm in IBM WebSphere Application Server Liberty - CVE-2022-22310

Vulnerability identifier: #VU61581

CSH Severity: Low

CVSS v4: 5.3 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2022-22310

CWE-ID: CWE-327

Exploitation vector: Adjecent network

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to perform MitM attack.

The vulnerability exists due to usage of a weak cryptographic algorithms. A remote attacker can intercept and decrypt traffic.

IBM WebSphere Application Server Liberty
IBM Cloud Transformation Advisor
IBM IoT MessageSight
IBM WIoTP MessageGateway
IBM Transformation Extender Advanced
IBM Common Licensing
IBM Copy Services Manager

Install updates from vendor's website.

IBM Cloud Transformation Advisor - update to 3.1.0
IBM WIoTP MessageGateway - update to 5.0.0.2
IBM Transformation Extender Advanced - addressed in versions 9.0.2.6, 10.0.1.7
IBM Copy Services Manager - update to 6.3.2
IBM Common Licensing - update to 9.0.0.1

• https://www.ibm.com/support/pages/node/6541530

• MitM attack in IBM WebSphere Application Server Liberty
• MitM attack in IBM Transformation Extender Advanced
• Multiple vulnerabilities in IBM WIoTP MessageGateway/IoT MessageSight
• Multiple vulnerabilities in IBM Cloud Transformation Advisor
• Multiple vulnerabilities in IBM Copy Services Manager
• Multiple vulnerabilities in IBM Common Licensing