CVE-2022-43917 — Use of a Broken or Risky Cryptographic Algorithm in IBM Websphere Application Server

CWE-327 — Use of a Broken or Risky Cryptographic Algorithm3 documents3 sources
Severity
7.5HIGHNVD
CNA5.9
EPSS
0.1%
top 70.34%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
IBM Websphere Application Server
Timeline
PublishedJan 26

Description

IBM WebSphere Application Server 8.5 and 9.0 traditional container uses weaker than expected cryptographic keys that could allow an attacker to decrypt sensitive information. This affects only the containerized version of WebSphere Application Server traditional. IBM X-Force ID: 241045.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:NExploitability: 3.9 | Impact: 3.6

Affected Packages2 packages

Patches

Patch: www.ibm.com ↗Patch: www.ibm.com ↗

🔴Vulnerability Details

2
GHSA
GHSA-hh46-3h2m-rhw6: IBM WebSphere Application Server 8↗2023-01-26
▶
CVEList
IBM WebSphere Application Server information disclosure↗2023-01-25
▶
CVE-2022-43917 — IBM vulnerability | cvebase