CVE-2022-35646: IBM Security Verify Governance, Identity Manager security bypass

Published Dec 22, 2022

Updated

IBM Security Verify Governance, Identity Manager 10.0.1 software component could allow an authenticated user to modify or cancel any other user's access request using man-in-the-middle techniques. IBM X-Force ID: 231096.

Affected Software

5 affected components

IBM Security Verify Governance=10.0.1

IBM AIX

Linux Linux kernel

Microsoft Windows

Oracle Solaris

Remediation

Patch Available

https://www.ibm.com/support/pages/node/6850809

Event History

Dec 22, 2022

CVE Published

via MITRE·07:08 PM

Data Sourced

via MITRE·07:08 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What is the severity of CVE-2022-35646?

The severity of CVE-2022-35646 is medium with a score of 5.3.

How can an authenticated user exploit CVE-2022-35646?

An authenticated user can exploit CVE-2022-35646 by using man-in-the-middle techniques to modify or cancel another user's access request.

Which software component is affected by CVE-2022-35646?

IBM Security Verify Governance, Identity Manager 10.0.1 is the affected software component for CVE-2022-35646.

Are other operating systems vulnerable to CVE-2022-35646?

No, other operating systems such as IBM AIX, Linux kernel, Microsoft Windows, and Oracle Solaris are not vulnerable to CVE-2022-35646.

Where can I find more information about CVE-2022-35646?

You can find more information about CVE-2022-35646 on the IBM X-Force website and the IBM Support pages.