CVE-2022-40615: IBM Sterling Partner Engagement Manager SQL injection

Reference Links

• https://exchange.xforce.ibmcloud.com/vulnerabilities/236208
• https://www.ibm.com/support/pages/node/6854333 (Advisory)

Parent vulnerabilities

(Appears in the following advisories)

• IBM-6854333

Frequently Asked Questions

• What is the severity of CVE-2022-40615?

  The severity of CVE-2022-40615 is critical with a CVSS score of 9.8.

• Which versions of IBM Sterling Partner Engagement Manager are affected by CVE-2022-40615?

  IBM Sterling Partner Engagement Manager versions 6.1.2, 6.2.0, and 6.2.1 are affected by CVE-2022-40615.

• How does CVE-2022-40615 impact IBM Sterling Partner Engagement Manager?

  CVE-2022-40615 allows a remote attacker to send specially crafted SQL statements, leading to SQL injection vulnerabilities that could allow unauthorized access to and manipulation of the back-end database of IBM Sterling Partner Engagement Manager.

• Are there any workarounds for CVE-2022-40615?

  As of now, there are no known workarounds for CVE-2022-40615. It is recommended to apply the official patches or updates provided by IBM to mitigate the vulnerability.

• Where can I find more information about CVE-2022-40615?

  You can find more information about CVE-2022-40615 on the IBM X-Force Exchange website (https://exchange.xforce.ibmcloud.com/vulnerabilities/236208) and in the IBM support page (https://www.ibm.com/support/pages/node/6854333).