CVE-2022-42438 : IBM Cloud Pak for Multicloud Management Monitoring 2.0 and 2.3 allows users with

IBM Cloud Pak for Multicloud Management Monitoring 2.0 and 2.3 allows users without admin roles access to admin functions by specifying direct URL paths. IBM X-Force ID: 238210.

Published 2023-02-08 19:15:11

Updated 2023-02-18 21:05:32

Source IBM Corporation

View at NVD, CVE.org

Products affected by CVE-2022-42438

IBM » Cloud Pak For Multicloud Management Monitoring
Versions from including (>=) 2.0.0 and before (<) 2.3.0
cpe:2.3:a:ibm:cloud_pak_for_multicloud_management_monitoring:*:*:*:*:*:*:*:*
Matching versions
When used together with: Linux » Linux Kernel » Version: N/A
IBM » Cloud Pak For Multicloud Management Monitoring » Version: 2.3.0 Update Fixpack4
cpe:2.3:a:ibm:cloud_pak_for_multicloud_management_monitoring:2.3.0:fixpack4:*:*:*:*:*:*
Matching versions
When used together with: Linux » Linux Kernel » Version: N/A
IBM » Cloud Pak For Multicloud Management Monitoring » Version: 2.3.0
cpe:2.3:a:ibm:cloud_pak_for_multicloud_management_monitoring:2.3.0:*:*:*:*:*:*:*
Matching versions
When used together with: Linux » Linux Kernel » Version: N/A
IBM » Cloud Pak For Multicloud Management Monitoring » Version: 2.3.0 Update Fixpack5
cpe:2.3:a:ibm:cloud_pak_for_multicloud_management_monitoring:2.3.0:fixpack5:*:*:*:*:*:*
Matching versions
When used together with: Linux » Linux Kernel » Version: N/A
IBM » Cloud Pak For Multicloud Management Monitoring » Version: 2.3.0 Update Fixpack3
cpe:2.3:a:ibm:cloud_pak_for_multicloud_management_monitoring:2.3.0:fixpack3:*:*:*:*:*:*
Matching versions
When used together with: Linux » Linux Kernel » Version: N/A
IBM » Cloud Pak For Multicloud Management Monitoring » Version: 2.3.0 Update Fixpack2
cpe:2.3:a:ibm:cloud_pak_for_multicloud_management_monitoring:2.3.0:fixpack2:*:*:*:*:*:*
Matching versions
When used together with: Linux » Linux Kernel » Version: N/A

Exploit prediction scoring system (EPSS) score for CVE-2022-42438

EPSS FAQ

0.09%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 40 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2022-42438

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
8.8	HIGH	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	2.8	5.9	NIST
Attack Vector: Network Attack Complexity: Low Privileges Required: Low User Interaction: None Scope: Unchanged Confidentiality: High Integrity: High Availability: High
7.5	HIGH	CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H	1.6	5.9	IBM Corporation
Attack Vector: Network Attack Complexity: High Privileges Required: None User Interaction: Required Scope: Unchanged Confidentiality: High Integrity: High Availability: High

CWE ids for CVE-2022-42438

CWE-269 Improper Privilege Management

The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.

Assigned by: nvd@nist.gov (Primary)

References for CVE-2022-42438

https://exchange.xforce.ibmcloud.com/vulnerabilities/238210

IBM Cloud Pak for Multicloud Management Monitoring privilege escalation CVE-2022-42438 Vulnerability Report
VDB Entry;Vendor Advisory
https://www.ibm.com/support/pages/node/6909427

Security Bulletin: IBM Cloud Pak for Multicloud Management Monitoring has applied security fixes for user privilege escalation
Patch;Vendor Advisory

Jump to

Vulnerability Details : CVE-2022-42438

Products affected by CVE-2022-42438

Exploit prediction scoring system (EPSS) score for CVE-2022-42438

CVSS scores for CVE-2022-42438

CWE ids for CVE-2022-42438

References for CVE-2022-42438