CVE-2022-43900 IBM WebSphere Automation for IBM Cloud Pak for Watson AIOps security bypass

Medium 5.3 Published 1 Dec 2022 Updated 23 Apr 2025

A local attacker can bypass security controls to create outbound network connections in IBM WebSphere Automation for Cloud Pak for Watson AIOps.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Local or same network only
Victim action needed: Not needed
Fix: None listed

What is CVE-2022-43900?

CVE-2022-43900 is a medium-severity vulnerability in WebSphere Automation for IBM Cloud Pak for Watson AIOps, published on 1 Dec 2022. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

IBM WebSphere Automation for IBM Cloud Pak for Watson AIOps 1.4.2 could provide a weaker than expected security. A local attacker can create an outbound network connection to another system. IBM X-Force ID: 240827.

Weakness: CWE-287

Which versions are affected by CVE-2022-43900?

It affects 1 product.

Products include Ibm Websphere Automation for Ibm Cloud Pak for Watson Aiops.

How do I fix CVE-2022-43900?

No fix has been published for CVE-2022-43900 yet. Limit exposure of the affected software until one is available.

Is CVE-2022-43900 being exploited?

There is no known exploitation of CVE-2022-43900 in the wild and no public exploit code.

Sources

Also known as GHSA-5rmg-hj9w-vg6v.