CVE-2022-22487
First published: Wed Jun 29 2022(Updated: )
An IBM Spectrum Protect storage agent could allow a remote attacker to perform a brute force attack by allowing unlimited attempts to login to the storage agent without locking the administrative ID. A remote attacker could exploit this vulnerability using brute force techniques to gain unauthorized administrative access to both the IBM Spectrum Protect storage agent and the IBM Spectrum Protect Server 8.1.0.000 through 8.1.14 with which it communicates. IBM X-Force ID: 226326.
Credit: psirt@us.ibm.com psirt@us.ibm.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| IBM Spectrum Protect Server | >=8.1.0.000<=8.1.14 | |
| IBM AIX | ||
| Linux Linux kernel | ||
| Microsoft Windows | ||
| <=8.1.0.000-8.1.14.xxx |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2022-22487?
The severity of CVE-2022-22487 is critical with a CVSS score of 9.8.
How does CVE-2022-22487 impact IBM Spectrum Protect Server?
CVE-2022-22487 allows a remote attacker to perform a brute force attack on the IBM Spectrum Protect storage agent, potentially gaining unauthorized access to the server.
Which versions of IBM Spectrum Protect Server are affected by CVE-2022-22487?
Versions 8.1.0.000 to 8.1.14 of IBM Spectrum Protect Server are affected by CVE-2022-22487.
Is IBM AIX affected by CVE-2022-22487?
No, IBM AIX is not affected by CVE-2022-22487.
How can CVE-2022-22487 be mitigated?
To mitigate CVE-2022-22487, it is recommended to update IBM Spectrum Protect Server to a version that is not vulnerable and ensure strong administrative ID credentials are used.
- collector/nvd-api
- collector/nvd-index
- agent/references
- agent/author
- agent/type
- agent/first-publish-date
- collector/mitre-cve
- source/MITRE
- agent/remedy
- agent/last-modified-date
- agent/severity
- agent/weakness
- agent/softwarecombine
- agent/tags
- agent/description
- agent/event
- collector/ibm-support
- source/IBM
- agent/software-canonical-lookup
- vendor/ibm
- canonical/ibm spectrum protect server
- version/ibm spectrum protect server/8.1.0.000
- version/ibm spectrum protect server/8.1.14
- canonical/ibm aix
- vendor/linux
- canonical/linux linux kernel
- vendor/microsoft
- canonical/microsoft windows
- version/ibm spectrum protect server/8.1.0.000-8.1.14.xxx