CVE-2022-22330 Information disclosure in Control Desk

What is CVE-2022-22330?

CVE-2022-22330 is a low-severity vulnerability in IBM Control Desk, published on 13 Sep 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

IBM Control Desk 7.6.1 could allow a remote attacker to obtain sensitive information, caused by the failure to set the HTTPOnly flag. A remote attacker could exploit this vulnerability to obtain sensitive information from the cookie. IBM X-Force ID: 219126.

Weakness: CWE-732

Which versions are affected by CVE-2022-22330?

It affects 1 product.

Products include Ibm Control Desk.

How do I fix CVE-2022-22330?

No fix has been published for CVE-2022-22330 yet. Limit exposure of the affected software until one is available.

Is CVE-2022-22330 being exploited?

There is no known exploitation of CVE-2022-22330 in the wild and no public exploit code.

Other vulnerabilities in IBM Control Desk

• CVE-2020-4409 Open redirect in Maximo Asset Management Medium 6.8
• CVE-2018-2028 Open redirect in Maximo Asset Management Medium 6.5
• CVE-2019-4644 Cross-site scripting in Maximo Asset Management Medium 6.1
• CVE-2019-4364 Code injection in Maximo Asset Management Medium 5.5
• CVE-2021-20559 Cross-site scripting in Control Desk Medium 5.4

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-2p6v-c8r2-4f2q.