CVE-2022-22331 Missing authorization in SterlingPartner Engagement Manager
Remote authenticated attackers can access or modify other users' data due to insecure direct object references in IBM Sterling Partner Engagement Manager.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2022-22331?
CVE-2022-22331 is a medium-severity missing authorization vulnerability in IBM SterlingPartner Engagement Manager, published on 1 Apr 2022. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
IBM SterlingPartner Engagement Manager 6.2.0 could allow a remote authenticated attacker to obtain sensitive information or modify user details caused by an insecure direct object vulnerability (IDOR). IBM X-Force ID: 219130.
Weakness: CWE-639
Which versions are affected by CVE-2022-22331?
It affects 1 product.
Products include Ibm Partner Engagement Manager.
How do I fix CVE-2022-22331?
No fix has been published for CVE-2022-22331 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2022-22331 being exploited?
There is no known exploitation of CVE-2022-22331 in the wild and no public exploit code.
Other vulnerabilities in IBM SterlingPartner Engagement Manager
- CVE-2021-29781 Deserialization in Partner Engagement Manager
- CVE-2022-22360 Other in Sterling Partner Engagement Manager
- CVE-2022-22358 XML external entity in Sterling Partner Engagement Manager
- CVE-2022-22328 Privilege escalation in SterlingPartner Engagement Manager
- CVE-2022-22332 Security feature bypass in Sterling Partner Engagement Manager
Sources
Also known as GHSA-4m3m-pj87-8xhf.