CVE-2022-34312 : IBM CICS TX 11.1 allows web pages to be stored locally which can be read by anot

IBM CICS TX 11.1 allows web pages to be stored locally which can be read by another user on the system. IBM X-Force ID: 229447.

Published 2022-11-14 18:15:17

Updated 2022-11-16 20:24:59

Source IBM Corporation

View at NVD, CVE.org

Vulnerability category: Information leak

Products affected by CVE-2022-34312

IBM » Cics Tx » Version: 11.1 Advanced Edition
cpe:2.3:a:ibm:cics_tx:11.1:*:*:*:advanced:*:*:*
Matching versions
IBM » Cics Tx » Version: 11.1 Standard Edition
cpe:2.3:a:ibm:cics_tx:11.1:*:*:*:standard:*:*:*
Matching versions

EPSS FAQ

0.05%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 17 %

Percentile, the proportion of vulnerabilities that are scored at or less

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
3.3	LOW	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N	1.8	1.4	NIST
Attack Vector: Local Attack Complexity: Low Privileges Required: Low User Interaction: None Scope: Unchanged Confidentiality: Low Integrity: None Availability: None
4.0	MEDIUM	CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N	2.5	1.4	IBM Corporation
Attack Vector: Local Attack Complexity: Low Privileges Required: None User Interaction: None Scope: Unchanged Confidentiality: Low Integrity: None Availability: None

CWE-200 Exposure of Sensitive Information to an Unauthorized Actor

The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

Assigned by: psirt@us.ibm.com (Secondary)
CWE-922 Insecure Storage of Sensitive Information

The product stores sensitive information without properly limiting read or write access by unauthorized actors.

Assigned by: nvd@nist.gov (Primary)

https://exchange.xforce.ibmcloud.com/vulnerabilities/229447

VDB Entry;Vendor Advisory
https://www.ibm.com/support/pages/node/6833150

Security Bulletin: IBM CICS TX Standard is vulnerable to allowing web pages to be stored locally which can then be accessed by other users on the system (CVE-2022-34312).
Patch;Vendor Advisory
https://www.ibm.com/support/pages/node/6833156

Security Bulletin: IBM CICS TX Advanced is vulnerable to allowing web pages to be stored locally which can then be read by other users on the system (CVE-2022-34312).
Patch;Vendor Advisory

Jump to