Vulnerability Details : CVE-2022-22485
In some cases, an unsuccessful attempt to log into IBM Spectrum Protect Operations Center 8.1.0.000 through 8.1.14.000 does not cause the administrator's invalid sign-on count to be incremented on the IBM Spectrum Protect Server. An attacker could exploit this vulnerability using brute force techniques to gain unauthorized administrative access to the IBM Spectrum Protect Server. IBM X-Force ID: 226325.
Vulnerability category: BypassGain privilege
Products affected by CVE-2022-22485
- IBM » Spectrum Protect Operations CenterVersions from including (>=) 8.1.0.000 and up to, including, (<=) 8.1.14.000cpe:2.3:a:ibm:spectrum_protect_operations_center:*:*:*:*:*:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2022-22485
0.16%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 52 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2022-22485
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
7.5
|
HIGH | AV:N/AC:L/Au:N/C:P/I:P/A:P |
10.0
|
6.4
|
NIST | |
|
5.9
|
MEDIUM | CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N |
2.2
|
3.6
|
IBM Corporation | |
|
9.8
|
CRITICAL | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
3.9
|
5.9
|
NIST |
CWE ids for CVE-2022-22485
-
When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.Assigned by: nvd@nist.gov (Primary)
References for CVE-2022-22485
-
https://www.ibm.com/support/pages/node/6595655
Security Bulletin: IBM Spectrum Protect Server may not count invalid sign-on attempts from Operations Center (CVE-2022-224485)Patch;Vendor Advisory
-
https://exchange.xforce.ibmcloud.com/vulnerabilities/226325
IBM Spectrum Protect Server information disclosure CVE-2022-22485 Vulnerability ReportVDB Entry;Vendor Advisory
Jump to