CVE-2022-38712 : "IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 Web services could allo

"IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 Web services could allow a man-in-the-middle attacker to conduct SOAPAction spoofing to execute unwanted or unauthorized operations. IBM X-Force ID: 234762."

Published 2022-11-03 20:15:30

Updated 2022-11-04 15:16:46

Source IBM Corporation

View at NVD, CVE.org

Products affected by CVE-2022-38712

IBM » Websphere Application Server
Versions from including (>=) 8.5.0.0 and before (<) 8.5.5.23
cpe:2.3:a:ibm:websphere_application_server:*:*:*:*:*:*:*:*
Matching versions
When used together with: HP » Hp-ux » Version: N/A
When used together with: IBM » AIX » Version: N/A
When used together with: IBM » I » Version: N/A
When used together with: IBM » Z/os » Version: N/A
When used together with: Linux » Linux Kernel » Version: N/A
When used together with: Microsoft » Windows » Version: N/A
When used together with: Oracle » Solaris » Version: N/A
IBM » Websphere Application Server
Versions from including (>=) 8.0.0.0 and before (<) 8.0.0.15
cpe:2.3:a:ibm:websphere_application_server:*:*:*:*:*:*:*:*
Matching versions
When used together with: HP » Hp-ux » Version: N/A
When used together with: IBM » AIX » Version: N/A
When used together with: IBM » I » Version: N/A
When used together with: IBM » Z/os » Version: N/A
When used together with: Linux » Linux Kernel » Version: N/A
When used together with: Microsoft » Windows » Version: N/A
When used together with: Oracle » Solaris » Version: N/A
IBM » Websphere Application Server
Versions from including (>=) 7.0.0.0 and before (<) 7.0.0.45
cpe:2.3:a:ibm:websphere_application_server:*:*:*:*:*:*:*:*
Matching versions
When used together with: HP » Hp-ux » Version: N/A
When used together with: IBM » AIX » Version: N/A
When used together with: IBM » I » Version: N/A
When used together with: IBM » Z/os » Version: N/A
When used together with: Linux » Linux Kernel » Version: N/A
When used together with: Microsoft » Windows » Version: N/A
When used together with: Oracle » Solaris » Version: N/A
IBM » Websphere Application Server
Versions from including (>=) 9.0.0.0 and before (<) 9.0.5.14
cpe:2.3:a:ibm:websphere_application_server:*:*:*:*:*:*:*:*
Matching versions
When used together with: HP » Hp-ux » Version: N/A
When used together with: IBM » AIX » Version: N/A
When used together with: IBM » I » Version: N/A
When used together with: IBM » Z/os » Version: N/A
When used together with: Linux » Linux Kernel » Version: N/A
When used together with: Microsoft » Windows » Version: N/A
When used together with: Oracle » Solaris » Version: N/A

Exploit prediction scoring system (EPSS) score for CVE-2022-38712

EPSS FAQ

0.06%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 26 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2022-38712

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source	First Seen
5.9	MEDIUM	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N	2.2	3.6	NIST
Attack Vector: Network Attack Complexity: High Privileges Required: None User Interaction: None Scope: Unchanged Confidentiality: None Integrity: High Availability: None

CWE ids for CVE-2022-38712

CWE-290 Authentication Bypass by Spoofing

This attack-focused weakness is caused by incorrectly implemented authentication schemes that are subject to spoofing attacks.

Assigned by: nvd@nist.gov (Primary)

References for CVE-2022-38712

https://www.ibm.com/support/pages/node/6829907

Security Bulletin: IBM WebSphere Application Server is vulnerable to SOAPAction spoofing (CVE-2022-38712)
Patch;Vendor Advisory

Jump to

Vulnerability Details : CVE-2022-38712

Products affected by CVE-2022-38712

Exploit prediction scoring system (EPSS) score for CVE-2022-38712

CVSS scores for CVE-2022-38712

CWE ids for CVE-2022-38712

References for CVE-2022-38712