CVE-2022-43877 — Insecure Storage of Sensitive Information in IBM Urbancode Deploy

CWE-922 — Insecure Storage of Sensitive Information4 documents4 sources
Severity
5.5MEDIUMNVD
CNA5.1
EPSS
0.0%
top 91.46%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
IBM Urbancode Deploy
Timeline
PublishedMay 6

Description

IBM UrbanCode Deploy (UCD) versions up to 7.3.0.1 could disclose sensitive password information during a manual edit of the agentrelay.properties file. IBM X-Force ID: 240148.

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:NExploitability: 1.8 | Impact: 3.6

Affected Packages2 packages

▶NVDibm/urbancode_deploy6.2.0.0 — 6.2.7.20+4
▶CVEListV5ibm/urbancode_deploy6.2 — 6.2.7.19+4

Patches

Patch: www.ibm.com ↗Patch: www.ibm.com ↗

🔴Vulnerability Details

2
CVEList
IBM UrbanCode Deploy (UCD) information disclosure↗2023-05-06
▶
GHSA
GHSA-2vgj-m9p7-c6jm: IBM UrbanCode Deploy (UCD) versions up to 7↗2023-05-06
▶

📋Vendor Advisories

1
Microsoft
ASP.NET Core and Visual Studio Elevation of Privilege Vulnerability↗2021-12-14
▶
CVE-2022-43877 — IBM Urbancode Deploy vulnerability | cvebase