Security Bulletin: Digital Certificate Manager for IBM i is vulnerable to cross-site scripting (CVE-2022-34358)

Security Bulletin

Summary

Digital Certificate Manager for IBM i is vulnerable to a cross-site scripting issue in the old web application as described in the vulnerability details section. IBM i has addressed the applicable CVE with a fix to the Digital Certificate Manage web application as described in the remediation/fixes section.

Vulnerability Details

CVEID: CVE-2022-34358
DESCRIPTION: IBM i is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.
CVSS Base score: 5.4
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/230516 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N)

Affected Products and Versions

Affected Product(s)	Version(s)
IBM i	7.5
IBM i	7.4
IBM i	7.3
IBM i	7.2

Remediation/Fixes

The original reported issue can be fixed by applying a PTF to IBM i. IBM i releases 7.5, 7.4, 7.3, and 7.2 will be fixed.

The IBM i PTF numbers contain the fix for the vulnerability.

IBM i Release	5770-SS1 PTF Number	PTF Download Link
7.5	SI80415	SI80415
7.4	SI80414	SI80414
7.3	SI80413	SI80413
7.2	SI80412	SI80412

Additional URLs were identified that can be used for a cross-site scripting attack resulting in superseded PTFs.

The IBM i superseding PTF numbers contain the fix for the vulnerability.

IBM i Release	5770-SS1 PTF Number	PTF Download Link
7.5	SI81854	SI81854
7.4	SI81853	SI81853
7.3	SI81852	SI81852
7.2	SI81845	SI81845

It is recommended that the heritage version of Digital Certificate Manager not be used.
PTFs are available that disable the heritage version of Digital Certificate Manager.
IBM i releases 7.5, 7.4, and 7.3 will be disabled.

The IBM i PTF numbers to disable heritage version of Digital Certificate Manager.

IBM i Release	5770-DG1 PTF Number	PTF Download Link
7.5	SI81417	SI81417
7.4	SI81418	SI81418
7.3	SI81419	SI81419

https://www.ibm.com/support/fixcentral

Important note: IBM recommends that all users running unsupported versions of affected products upgrade to supported and fixed version of affected products.

Workarounds and Mitigations

Instead of using the heritage version of Digital Certificate Manager, it is recommended to use the new IBM Digital Certificate Manager for i user interface by specifying this URL: http://systemname:2001/dcm

Get Notified about Future Security Bulletins

Subscribe to My Notifications to be notified of important product support alerts like this.

References

Complete CVSS v3 Guide
On-line Calculator v3

Off

Review this information as needed, no action required.
Heritage Digital Certificate Manager Enable and Disable Instructions (ibm.com)

Acknowledgement

Penetration tester working with Banque Nationale Du Canada

Change History

12 Jul 2022: Initial Publication28 Nov 2022: Superseded PTFs and disable heritage version of Digital Certificate Manager

*The CVSS Environment Score is customer environment specific and will ultimately impact the Overall CVSS Score. Customers can evaluate the impact of this vulnerability in their environments by accessing the links in the Reference section of this Security Bulletin.

Disclaimer

Review the IBM security bulletin disclaimer and definitions regarding your responsibilities for assessing potential impact of security vulnerabilities to your environment.

Document Location

Worldwide

[{"Business Unit":{"code":"BU058","label":"IBM Infrastructure w\/TPS"},"Product":{"code":"SSB23CE","label":"IBM i 7.5 Preventative Service Planning"},"Component":"","Platform":[{"code":"PF012","label":"IBM i"}],"Version":"7.5.0","Edition":"","Line of Business":{"code":"LOB57","label":"Power"}},{"Business Unit":{"code":"BU058","label":"IBM Infrastructure w\/TPS"},"Product":{"code":"SWG60","label":"IBM i"},"Component":"","Platform":[{"code":"PF012","label":"IBM i"}],"Version":"7.5.0,7.4.0,7.3.0,7.2.0","Edition":"","Line of Business":{"code":"LOB57","label":"Power"}},{"Business Unit":{"code":"BU058","label":"IBM Infrastructure w\/TPS"},"Product":{"code":"SSC5L9","label":"IBM i 7.2 Preventative Service Planning"},"Component":"","Platform":[{"code":"PF012","label":"IBM i"}],"Version":"7.2.0","Edition":"","Line of Business":{"code":"LOB57","label":"Power"}},{"Business Unit":{"code":"BU058","label":"IBM Infrastructure w\/TPS"},"Product":{"code":"SS9QQS","label":"IBM i 7.4 Preventative Service Planning"},"Component":"","Platform":[{"code":"PF012","label":"IBM i"}],"Version":"7.4.0","Edition":"","Line of Business":{"code":"LOB57","label":"Power"}},{"Business Unit":{"code":"BU058","label":"IBM Infrastructure w\/TPS"},"Product":{"code":"SSTS2D","label":"IBM i 7.3 Preventative Service Planning"},"Component":"","Platform":[{"code":"PF012","label":"IBM i"}],"Version":"7.3.0","Edition":"","Line of Business":{"code":"LOB57","label":"Power"}}]

Tips

Security Bulletin: Digital Certificate Manager for IBM i is vulnerable to cross-site scripting (CVE-2022-34358)