CVE-2022-43874

CVSS V2 None CVSS V3 None
Description
IBM App Connect Enterprise Certified Container 4.1, 4.2, 5.0, 5.1, 5.2, 6.0, 6.1, 6.2, and 7.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 239963.
Overview
  • CVE ID
  • CVE-2022-43874
  • Assigner
  • psirt@us.ibm.com
  • Vulnerability Status
  • Analyzed
  • Published Version
  • 2023-03-15T18:15:10
  • Last Modified Date
  • 2023-03-17T19:32:32
Weakness Enumerations
CWE URL
CWE-79 http://cwe.mitre.org/data/definitions/79.html
CWE-79 http://cwe.mitre.org/data/definitions/79.html
CPE Configuration (Product)
CPE Vulnerable Operator Version Start Version End
cpe:2.3:a:ibm:app_connect_enterprise_certified_container:4.1:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:ibm:app_connect_enterprise_certified_container:4.2:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:ibm:app_connect_enterprise_certified_container:5.0:*:*:*:lts:*:*:* 1 OR
cpe:2.3:a:ibm:app_connect_enterprise_certified_container:5.1:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:ibm:app_connect_enterprise_certified_container:5.2:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:ibm:app_connect_enterprise_certified_container:6.0:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:ibm:app_connect_enterprise_certified_container:6.1:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:ibm:app_connect_enterprise_certified_container:6.2:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:ibm:app_connect_enterprise_certified_container:7.0:*:*:*:*:*:*:* 1 OR
References
Reference URL Reference Tags
https://exchange.xforce.ibmcloud.com/vulnerabilities/239963 VDB Entry Vendor Advisory
https://www.ibm.com/support/pages/node/6960189 Vendor Advisory
Sources
Source Name Source URL
NIST https://nvd.nist.gov/vuln/detail/CVE-2022-43874
MITRE https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-43874
History
Created Old Value New Value Data Type Notes
2023-04-17 06:30:53 Added to TrackCVE
2023-04-17 06:30:56 Weakness Enumeration new