CVE-2022-22349: IBM Sterling External Authentication Server 3.4.3.2, 6.0.2.0, and 6.0.3.0 is vulnerable to path traversals, due to not properly validating RESTAPI…

PriorityP421medium4.3CVSS 3.1

AVNACLPRLUINSUCNILAN

EPSS

0.98%

58.2th percentile

IBM Sterling External Authentication Server 3.4.3.2, 6.0.2.0, and 6.0.3.0 is vulnerable to path traversals, due to not properly validating RESTAPI configuration data. An authorized user could import invalid data which could be used for an attack. IBM X-Force ID: 220144.

Affected

3 ranges

Vendor	Product	Version range	Fixed in
ibm	sterling_external_authentication_server	—	—
ibm	sterling_external_authentication_server	—	—
ibm	sterling_external_authentication_server	—	—

CVSS provenance

nvdv3.14.3MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

nvdv3.04.3MEDIUMCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

nvdv2.04.0MEDIUMAV:N/AC:L/Au:S/C:N/I:P/A:N

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.