CVE-2022-22454: OS Command Injection

Q: What is CVE-2022-22454?

CVE-2022-22454 is a vulnerability in IBM InfoSphere Information Server 11.7 that allows a locally authenticated attacker to execute arbitrary commands on the system.

Q: How severe is CVE-2022-22454?

CVE-2022-22454 has a severity value of 7.8, which is considered high.

Q: Which software versions are affected by CVE-2022-22454?

IBM InfoSphere Information Server version 11.7 is affected by CVE-2022-22454.

Q: Is IBM AIX affected by CVE-2022-22454?

No, IBM AIX is not affected by CVE-2022-22454.

Q: Is there a patch available for CVE-2022-22454?

Yes, a patch is available for CVE-2022-22454. You can find it at the following URL: https://www.ibm.com/support/pages/node/878310

Published May 9, 2022

Updated

IBM InfoSphere Information Server 11.7 could allow a locally authenticated attacker to execute arbitrary commands on the system by sending a specially crafted request.

Other sources

IBM InfoSphere Information Server could allow a locally authenticated attacker to execute arbitrary commands on the system by sending a specially crafted request.

— IBM

Affected Software

5 affected componentsFixes available

IBM InfoSphere Information Server,Information Server on Cloud<=11.7

IBM Infosphere Information Server On Cloud=11.7

IBM AIX

Linux Linux kernel

Microsoft Windows

Remediation

Patch Available

https://www.ibm.com/support/pages/node/6584175

Event History

May 9, 2022

CVE Published

via IBM·12:00 AM

May 10, 2022

CVE Published

via MITRE·03:45 PM

Data Sourced

via MITRE·03:45 PM

DescriptionSeverityWeakness

Parent advisories

This vulnerability appears in the following advisories.

IBM-6584175

Frequently Asked Questions

What is CVE-2022-22454?

CVE-2022-22454 is a vulnerability in IBM InfoSphere Information Server 11.7 that allows a locally authenticated attacker to execute arbitrary commands on the system.

How severe is CVE-2022-22454?