CVE-2022-33165 IBM Security Directory Server information disclosure
Remote attackers can read arbitrary files on IBM Security Directory Server via directory traversal in URL requests.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2022-33165?
CVE-2022-33165 is a medium-severity path traversal vulnerability in IBM Security Directory Server, published on 14 Oct 2023. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
IBM Security Directory Server 6.4.0 could allow a remote attacker to traverse directories on the system. An attacker could send a specially-crafted URL request containing "dot dot" sequences (/../) to view arbitrary files on the system. IBM X-Force ID: 228582.
Weakness: CWE-22
Which versions are affected by CVE-2022-33165?
It affects 1 product.
Products include Ibm Security Directory Integrator.
How do I fix CVE-2022-33165?
No fix has been published for CVE-2022-33165 yet. Limit exposure of the affected software until one is available.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2022-33165 being exploited?
There is no known exploitation of CVE-2022-33165 in the wild and no public exploit code.
Other vulnerabilities in IBM Security Directory Server
- CVE-2022-33162 IBM Directory Server buffer overflow
- CVE-2024-28767 IBM Security Directory Integrator command execution
- CVE-2024-28772 IBM Security Directory Integrator cross-site scripting
- CVE-2024-28765 Security vulnerability was found in IBM Security Directory Integrator
- CVE-2022-32759 IBM Security Directory Server information disclosure
Sources
Also known as GHSA-2q58-xp4p-xpqc.