CVE-2022-43917 : IBM WebSphere Application Server 8.5 and 9.0 traditional container uses weaker t

IBM WebSphere Application Server 8.5 and 9.0 traditional container uses weaker than expected cryptographic keys that could allow an attacker to decrypt sensitive information. This affects only the containerized version of WebSphere Application Server traditional. IBM X-Force ID: 241045.

Published 2023-01-26 21:17:50

Updated 2023-02-01 20:44:03

Source IBM Corporation

View at NVD, CVE.org

Products affected by CVE-2022-43917

IBM » Websphere Application Server » Version: 8.5 Traditional Edition
cpe:2.3:a:ibm:websphere_application_server:8.5:*:*:*:traditional:*:*:*
Matching versions
When used together with: HP » Hp-ux » Version: N/A
When used together with: IBM » AIX » Version: N/A
When used together with: IBM » I » Version: N/A
When used together with: IBM » Z/os » Version: N/A
When used together with: Linux » Linux Kernel » Version: N/A
When used together with: Microsoft » Windows » Version: N/A
When used together with: Oracle » Solaris » Version: N/A
IBM » Websphere Application Server » Version: 9.0 Traditional Edition
cpe:2.3:a:ibm:websphere_application_server:9.0:*:*:*:traditional:*:*:*
Matching versions
When used together with: HP » Hp-ux » Version: N/A
When used together with: IBM » AIX » Version: N/A
When used together with: IBM » I » Version: N/A
When used together with: IBM » Z/os » Version: N/A
When used together with: Linux » Linux Kernel » Version: N/A
When used together with: Microsoft » Windows » Version: N/A
When used together with: Oracle » Solaris » Version: N/A

Exploit prediction scoring system (EPSS) score for CVE-2022-43917

EPSS FAQ

0.11%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 44 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2022-43917

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
7.5	HIGH	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N	3.9	3.6	NIST
Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: None Scope: Unchanged Confidentiality: High Integrity: None Availability: None
5.9	MEDIUM	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N	2.2	3.6	IBM Corporation
Attack Vector: Network Attack Complexity: High Privileges Required: None User Interaction: None Scope: Unchanged Confidentiality: High Integrity: None Availability: None

CWE ids for CVE-2022-43917

CWE-327 Use of a Broken or Risky Cryptographic Algorithm

The product uses a broken or risky cryptographic algorithm or protocol.
Assigned by:
- nvd@nist.gov (Primary)
- psirt@us.ibm.com (Secondary)

References for CVE-2022-43917

https://exchange.xforce.ibmcloud.com/vulnerabilities/241045

IBM WebSphere Application Server information disclosure CVE-2022-43917 Vulnerability Report
VDB Entry;Vendor Advisory
https://www.ibm.com/support/pages/node/6857007

Security Bulletin: IBM WebSphere Application Server traditional container is vulnerable to information disclosure (CVE-2022-43917)
Patch;Vendor Advisory

Jump to

Vulnerability Details : CVE-2022-43917

Products affected by CVE-2022-43917

Exploit prediction scoring system (EPSS) score for CVE-2022-43917

CVSS scores for CVE-2022-43917

CWE ids for CVE-2022-43917

References for CVE-2022-43917