CVE-2022-33166 IBM Security Directory Suite VA file upload
A privileged user can upload malicious files that are automatically processed, potentially leading to code execution within the IBM Security Directory Suite environment.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2022-33166?
CVE-2022-33166 is a high-severity vulnerability in IBM Security Directory Suite VA, published on 15 Jun 2023. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
IBM Security Directory Suite VA 8.0.1 through 8.0.1.19 could allow a privileged user to upload malicious files of dangerous types that can be automatically processed within the product's environment. IBM X-Force ID: 228586.
Weakness: CWE-434
Which versions are affected by CVE-2022-33166?
It affects 1 product.
Products include Ibm Security Directory Suite Va.
How do I fix CVE-2022-33166?
No fix has been published for CVE-2022-33166 yet. Limit exposure of the affected software until one is available.
Is CVE-2022-33166 being exploited?
There is no known exploitation of CVE-2022-33166 in the wild and no public exploit code.
Other vulnerabilities in IBM Security Directory Suite VA
- CVE-2022-32757 IBM Security Directory Suite VA information disclosure
- CVE-2022-33168 IBM Security Directory Suite VA denial of service
- CVE-2022-32752 IBM Security Directory Suite VA command execution
- CVE-2022-33159 IBM Security Directory Suite VA information disclosure
- CVE-2022-33163 IBM Security Directory Suite VA information disclosure
Sources
Also known as GHSA-fwrm-7p3m-q253.