CVE-2022-40228: IBM DataPower Gateway session fixation

Q: What is CVE-2022-40228?

CVE-2022-40228 is a vulnerability in IBM DataPower Gateway that allows an authenticated user to impersonate another user after a password change.

Q: What is the severity of CVE-2022-40228?

The severity of CVE-2022-40228 is medium, with a CVSS score of 5.4.

Q: Which versions of IBM DataPower Gateway are affected by CVE-2022-40228?

IBM DataPower Gateway versions 10.0.3.0 through 10.0.4.0, 10.0.1.0 through 10.0.1.9, 2018.4.1.0 through 2018.4.1.22, and 10.5.0.0 through 10.5.0.2 are affected by CVE-2022-40228.

Q: How can an attacker exploit CVE-2022-40228?

An attacker can exploit CVE-2022-40228 by using an authenticated session to impersonate another user on the system.

Q: Is there a fix for CVE-2022-40228?

Yes, IBM has released security updates to address the vulnerability CVE-2022-40228. It is recommended to update to the latest version of IBM DataPower Gateway.

Published Nov 8, 2022

Updated

IBM DataPower Gateway 10.0.3.0 through 10.0.4.0, 10.0.1.0 through 10.0.1.9, 2018.4.1.0 through 2018.4.1.22, and 10.5.0.0 through 10.5.0.2 does not invalidate session after a password change which could allow an authenticated user to impersonate another user on the system. IBM X-Force ID: 235527.

Other sources

IBM DataPower Gateway does not invalidate session after a password change which could allow an authenticated user to impersonate another user on the system.

— IBM

Affected Software

8 affected components

IBM DataPower Gateway>=10.0.1.0<=10.0.1.9

IBM DataPower Gateway>=10.0.3.0<=10.0.4.0

IBM DataPower Gateway>=10.5.0.0<=10.5.0.2

IBM DataPower Gateway>=2018.4.1.0<=2018.4.1.22

IBM DataPower Gateway V10CD<=10.0.3.0 - 10.0.4.0

IBM DataPower Gateway 10.0.1<=10.0.1.0 - 10.0.1.9

IBM DataPower Gateway 2018.4.1<=2018.4.1.0 - 2018.4.1.22

IBM DataPower Gateway 10.5.0<=10.5.0.0 - 10.5.0.2

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade IBM DataPower Gateway to a version that resolves this vulnerability.
Fixed in 10.0.3.0 through 10.0.4.0, 10.0.1.0 through 10.0.1.9, 2018.4.1.0 through 2018.4.1.22, and 10.5.0.0 through 10.5.0.2 does not invalidate session after a password changePatch IBM X-Force ID: 235527
Compensating control
Review and ensure session handling mitigations are in place for IBM DataPower Gateway session fixation (IBM X-Force ID: 235527), since affected versions do not invalidate sessions after a password change.

Event History

Nov 8, 2022

CVE Published

via IBM·12:00 AM

Nov 22, 2022

CVE Published

via MITRE·06:52 PM

Data Sourced

via MITRE·06:52 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·07:15 PM

DescriptionSeverityWeaknessAffected Software

Parent advisories

This vulnerability appears in the following advisories.

IBM-6840759

Frequently Asked Questions

What is CVE-2022-40228?