CVE-2022-22349: Path Traversal
First published: Wed Feb 23 2022(Updated: )
IBM Sterling External Authentication Server 3.4.3.2, 6.0.2.0, and 6.0.3.0 is vulnerable to path traversals, due to not properly validating RESTAPI configuration data. An authorized user could import invalid data which could be used for an attack. IBM X-Force ID: 220144.
Credit: psirt@us.ibm.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| IBM Sterling External Authentication Server | =3.4.3.2 | |
| IBM Sterling External Authentication Server | =6.0.2.0 | |
| IBM Sterling External Authentication Server | =6.0.3.0 | |
| IBM Sterling External Authentication Server | <=6.0.3 | |
| IBM Sterling External Authentication Server | <=6.0.2 | |
| IBM Sterling External Authentication Server | <=3.4.3.2 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2022-22349?
The severity of CVE-2022-22349 is medium with a severity value of 4.3.
Which version of IBM Sterling External Authentication Server is affected by CVE-2022-22349?
IBM Sterling External Authentication Server versions 3.4.3.2, 6.0.2.0, and 6.0.3.0 are affected by CVE-2022-22349.
How can an attack be carried out using CVE-2022-22349?
An authorized user could import invalid data through the RESTAPI configuration, allowing for path traversals and potential attacks.
What is the Common Weakness Enumeration (CWE) for CVE-2022-22349?
The CWE for CVE-2022-22349 is CWE-22.
How can I fix CVE-2022-22349?
You can patch the affected versions of IBM Sterling External Authentication Server. Please refer to the vendor's support page for the respective version.
- collector/nvd-index
- agent/references
- agent/type
- agent/first-publish-date
- collector/mitre-cve
- source/MITRE
- agent/severity
- agent/author
- agent/weakness
- agent/remedy
- agent/last-modified-date
- agent/description
- collector/ibm-support
- source/IBM
- agent/software-canonical-lookup
- agent/softwarecombine
- agent/tags
- agent/event
- agent/trending
- vendor/ibm
- canonical/ibm sterling external authentication server
- version/ibm sterling external authentication server/3.4.3.2
- version/ibm sterling external authentication server/6.0.2.0
- version/ibm sterling external authentication server/6.0.3.0
- version/ibm sterling external authentication server/6.0.3
- version/ibm sterling external authentication server/6.0.2