CVE-2022-22487: Critical severity IBM Spectrum Protect Server vulnerability
An IBM Spectrum Protect storage agent could allow a remote attacker to perform a brute force attack by allowing unlimited attempts to login to the storage agent without locking the administrative ID. A remote attacker could exploit this vulnerability using brute force techniques to gain unauthorized administrative access to both the IBM Spectrum Protect storage agent and the IBM Spectrum Protect Server 8.1.0.000 through 8.1.14 with which it communicates. IBM X-Force ID: 226326.
Other sources
An IBM Spectrum Protect storage agent could allow a remote attacker to perform a brute force attack by allowing unlimited attempts to login to the storage agent without locking the administrative ID. A remote attacker could exploit this vulnerability using brute force techniques to gain unauthorized administrative access to both the IBM Spectrum Protect storage agent and the IBM Spectrum Protect server with which it communicates.
— IBM
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2022-22487?
The severity of CVE-2022-22487 is critical with a CVSS score of 9.8.
How does CVE-2022-22487 impact IBM Spectrum Protect Server?
CVE-2022-22487 allows a remote attacker to perform a brute force attack on the IBM Spectrum Protect storage agent, potentially gaining unauthorized access to the server.
Which versions of IBM Spectrum Protect Server are affected by CVE-2022-22487?
Versions 8.1.0.000 to 8.1.14 of IBM Spectrum Protect Server are affected by CVE-2022-22487.
Is IBM AIX affected by CVE-2022-22487?
No, IBM AIX is not affected by CVE-2022-22487.
How can CVE-2022-22487 be mitigated?
To mitigate CVE-2022-22487, it is recommended to update IBM Spectrum Protect Server to a version that is not vulnerable and ensure strong administrative ID credentials are used.