CVE-2022-22377
Last modified
CVE-2022-22377 is a medium-severity vulnerability rated 5.3/10 on the CVSS scale. IBM Security Verify Privilege On-Premises 11.5 could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable HTTP Strict Transport Security. An attacker could exploit this vulnerability to obtain sensitive information using man in the middle techniques. EPSS estimates a 0.48% chance of exploitation in the next 30 days.
Description
IBM Security Verify Privilege On-Premises 11.5 could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable HTTP Strict Transport Security. An attacker could exploit this vulnerability to obtain sensitive information using man in the middle techniques. IBM X-Force ID: 221827.
Metrics
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Ibm | Security Verify Privilege On-Premises | < 11.5 |
References
- https://exchange.xforce.ibmcloud.com/vulnerabilities/221827VDB Entry, Vendor Advisory
- https://www.ibm.com/support/pages/node/7047202Patch, Vendor Advisory
- https://exchange.xforce.ibmcloud.com/vulnerabilities/221827VDB Entry, Vendor Advisory
- https://www.ibm.com/support/pages/node/7047202Patch, Vendor Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2022-22377?
How severe is CVE-2022-22377?
How do I fix CVE-2022-22377?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2022
- CVE-2022-2237A flaw was found in the Keycloak Node.js Adapter. This flaw …6.1
- CVE-2022-22370IBM Security Verify Access 10.0.0.0, 10.0.1.0, 10.0.2.0, and…5.4
- CVE-2022-22371IBM Sterling B2B Integrator Standard Edition 6.0.0.0 through…6.5
- CVE-2022-22373An improper validation vulnerability in IBM InfoSphere Infor…5.4
- CVE-2022-22374The BMC (IBM Power 9 AC922 OP910, OP920, OP930, and OP940) m…9.1
- CVE-2022-22375 IBM Security Verify Privilege On-Premises 11.5 could allow …8.8
- CVE-2022-2238A vulnerability was found in the search-api container in Red…6.5
- CVE-2022-22380 IBM Security Verify Privilege On-Premises 11.5 could allow …4.3
- CVE-2022-22384 IBM Security Verify Privilege On-Premises 11.5 could allow …4.3
- CVE-2022-22385 IBM Security Verify Privilege On-Premises 11.5 could disclo…7.5
- CVE-2022-22386 IBM Security Verify Privilege On-Premises 11.5 could allow …5.9
- CVE-2022-22387IBM Application Gateway is vulnerable to cross-site scriptin…5.4
Are you affected by CVE-2022-22377?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST