CVE-2022-22380 IBM Security Verify Privilege improper authentication
Attackers can spoof trusted entities due to improper certificate validation in IBM Security Verify Privilege On-Premises.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2022-22380?
CVE-2022-22380 is a medium-severity authentication bypass vulnerability in IBM Security Verify Privilege, published on 17 Oct 2023. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
IBM Security Verify Privilege On-Premises 11.5 could allow an attacker to spoof a trusted entity due to improperly validating certificates. IBM X-Force ID: 221957.
Weakness: CWE-295
Which versions are affected by CVE-2022-22380?
It affects 1 product.
Products include Ibm Security Verify Privilege On-Premises.
How do I fix CVE-2022-22380?
No fix has been published for CVE-2022-22380 yet. Limit exposure of the affected software until one is available.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2022-22380 being exploited?
There is no known exploitation of CVE-2022-22380 in the wild and no public exploit code.
Other vulnerabilities in IBM Security Verify Privilege
- CVE-2024-31887 IBM Security Verify Privilege information disclosure
- CVE-2022-22375 IBM Security Verify Privilege command execution
- CVE-2021-29913 IBM Security Verify Privilege improper input validation
- CVE-2022-22385 IBM Security Verify Privilege information disclosure
- CVE-2022-43890 IBM Security Verify Privilege On-Premises information disclosure
Sources
Also known as GHSA-gj95-8384-wrh5.