CVE-2022-43860: IBM Navigator for i SQL injection

Q: What is the vulnerability ID for this IBM Navigator for i vulnerability?

The vulnerability ID for this IBM Navigator for i vulnerability is CVE-2022-43860.

Q: Which versions of IBM Navigator for i are affected by this vulnerability?

Versions 7.3, 7.4, and 7.5 of IBM Navigator for i are affected by this vulnerability.

Q: What is the severity rating for this IBM Navigator for i vulnerability?

The severity rating for this IBM Navigator for i vulnerability is medium, with a value of 4.3.

Q: How can an authenticated user exploit this vulnerability?

An authenticated user can exploit this vulnerability by performing an SQL injection to obtain sensitive information they are authorized to.

Q: Is there a fix available for this vulnerability?

Please refer to the IBM support page for information on available fixes for this vulnerability.

Published Dec 21, 2022

Updated

IBM Navigator for i 7.3, 7.4, and 7.5 could allow an authenticated user to obtain sensitive information they are authorized to but not while using this interface. By performing an SQL injection an attacker could see user profile attributes through this interface. IBM X-Force ID: 239305.

Affected Software

6 affected components

IBM i=7.3

IBM i=7.4

IBM i=7.5

IBM i<=7.5

IBM i<=7.4

IBM i<=7.3

Remediation

Patch Available

https://www.ibm.com/support/pages/node/6850801

Event History

Dec 21, 2022

CVE Published

via IBM·12:00 AM

Dec 22, 2022

CVE Published

via MITRE·08:53 PM

Data Sourced

via MITRE·08:53 PM

DescriptionSeverityWeakness

Dec 24, 2022

Data Sourced

via NVD·12:15 AM

RemedyDescriptionSeverityWeaknessAffected Software

Parent advisories

This vulnerability appears in the following advisories.

IBM-6850801

Frequently Asked Questions

What is the vulnerability ID for this IBM Navigator for i vulnerability?