CVE-2022-22332 — Operation on a Resource after Expiration or Release in IBM Sterling Partner Engagement Manager

CWE-672 — Operation on a Resource after Expiration or Release3 documents3 sources
Severity
7.5HIGHNVD
EPSS
0.2%
top 53.04%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
IBM Sterling Partner Engagement ManagerIBM Partner Engagement Manager
Timeline
PublishedApr 1
Latest updateApr 2

Description

IBM Sterling Partner Engagement Manager 6.2.0 could allow an attacker to impersonate another user due to missing revocation mechanism for the JWT token. IBM X-Force ID: 219131.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:NExploitability: 3.9 | Impact: 3.6

Affected Packages2 packages

Patches

Patch: www.ibm.com ↗Patch: www.ibm.com ↗

🔴Vulnerability Details

2
GHSA
GHSA-g96j-fpm6-qgvc: IBM Sterling Partner Engagement Manager 6↗2022-04-02
▶
CVEList
CVE-2022-22332: IBM Sterling Partner Engagement Manager 6↗2022-04-01
▶