Security Bulletin: IBM WebSphere Application Server Liberty for IBM i is vulnerable to identity spoofing and port status query (CVE-2022-22475 CVE-2022-22393)

Security Bulletin

Summary

IBM WebSphere Application Server Liberty for IBM i is vulnerable to identity spoofing by an authenticated user and the ability to obtain the status of application server ports as described in the vulnerability details section. IBM i has addressed the CVEs by providing fixes to IBM WebSphere Application Server Liberty for IBM i as described in the remediation/fixes section.

Vulnerability Details

CVEID: CVE-2022-22475
DESCRIPTION: IBM WebSphere Application Server Liberty and Open Liberty 17.0.0.3 through 22.0.0.5 are vulnerable to identity spoofing by an authenticated user. IBM X-Force ID: 225603.
CVSS Base score: 5
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/225603 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L)

CVEID: CVE-2022-22393
DESCRIPTION: IBM WebSphere Application Server Liberty 17.0.0.3 through 22.0.0.5 , with the adminCenter-1.0 feature configured, could allow an authenticated user to issue a request to obtain the status of HTTP/HTTPS ports which are accessible by the application server. IBM X-Force ID: 222078.
CVSS Base score: 3.1
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/222078 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N)

Affected Products and Versions

Affected Product(s)	Version(s)
IBM i	7.5
IBM i	7.4
IBM i	7.3
IBM i	7.2

Remediation/Fixes

The issues can be fixed by applying a PTF to IBM i. IBM i releases 7.5, 7.4, 7.3, and 7.2 will be fixed.

The IBM i PTF numbers contain the fixes for the vulnerabilities.

IBM i Release	5770-SS1 PTF Number	PTF Download Link
7.5	SI79987	SI79987
7.4	SI79988	SI79988
7.3	SI79990	SI79990
7.2	SI79991	SI79991

https://www.ibm.com/support/fixcentral

Important note: IBM recommends that all users running unsupported versions of affected products upgrade to supported and fixed version of affected products.

Workarounds and Mitigations

None

Get Notified about Future Security Bulletins

Subscribe to My Notifications to be notified of important product support alerts like this.

References

Complete CVSS v3 Guide
On-line Calculator v3

Off

Change History

15 Jun 2022: Initial Publication

*The CVSS Environment Score is customer environment specific and will ultimately impact the Overall CVSS Score. Customers can evaluate the impact of this vulnerability in their environments by accessing the links in the Reference section of this Security Bulletin.

Disclaimer

Review the IBM security bulletin disclaimer and definitions regarding your responsibilities for assessing potential impact of security vulnerabilities to your environment.

Document Location

Worldwide

[{"Business Unit":{"code":"BU058","label":"IBM Infrastructure w\/TPS"},"Product":{"code":"SWG60","label":"IBM i"},"Component":"N\/A","Platform":[{"code":"PF012","label":"IBM i"}],"Version":"7.5.0,7.4.0,7.3.0,7.2.0","Edition":"N\/A","Line of Business":{"code":"LOB57","label":"Power"}},{"Business Unit":{"code":"BU058","label":"IBM Infrastructure w\/TPS"},"Product":{"code":"SS9QQS","label":"IBM i 7.4"},"Component":"N\/A","Platform":[{"code":"PF012","label":"IBM i"}],"Version":"7.4.0","Edition":"N\/A","Line of Business":{"code":"LOB57","label":"Power"}},{"Business Unit":{"code":"BU058","label":"IBM Infrastructure w\/TPS"},"Product":{"code":"SSTS2D","label":"IBM i 7.3"},"Component":"N\/A","Platform":[{"code":"PF012","label":"IBM i"}],"Version":"7.3.0","Edition":"N\/A","Line of Business":{"code":"LOB57","label":"Power"}},{"Business Unit":{"code":"BU058","label":"IBM Infrastructure w\/TPS"},"Product":{"code":"SSC5L9","label":"IBM i 7.2"},"Component":"N\/A","Platform":[{"code":"PF012","label":"IBM i"}],"Version":"7.2.0","Edition":"N\/A","Line of Business":{"code":"LOB57","label":"Power"}}]

Tips

Security Bulletin: IBM WebSphere Application Server Liberty for IBM i is vulnerable to identity spoofing and port status query (CVE-2022-22475 CVE-2022-22393)