VulnerabilityModified
CVE-2022-43858
IBM Navigator for i 7.3, 7.4, and 7.5 could allow an authenticated user to access the file system and download files they are authorized to but not while using this interface.
MEDIUM 4.3EPSS 0.99%
Does this matter?
Lower severity and a low EPSS score (0.99%). Track it; it rarely justifies an emergency change on its own.
Description
IBM Navigator for i 7.3, 7.4, and 7.5 could allow an authenticated user to access the file system and download files they are authorized to but not while using this interface. The remote authenticated user can bypass the interface checks by modifying a parameter thereby gaining access to their files through this interface. IBM X-Force ID: 239303.
- CVSS 3.1
- 4.3 MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
- EPSS
- 0.99% probability · 61th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-22
- Affected
- ibm/i
- Source
- psirt@us.ibm.com
References
- https://exchange.xforce.ibmcloud.com/vulnerabilities/239303VDB Entry, Vendor Advisory
- https://www.ibm.com/support/pages/node/6850801Patch, Vendor Advisory
- https://exchange.xforce.ibmcloud.com/vulnerabilities/239303VDB Entry, Vendor Advisory
- https://www.ibm.com/support/pages/node/6850801Patch, Vendor Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.