« Volver al listado

CVE-2022-22311

Estado: ModificadaMedia (6.5)—

IBM Security Verify Access could allow a user, using man in the middle techniques, to obtain sensitive information or possibly change some information due to improper validiation of JWT tokens.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

IBM — Security Verify Access

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2022-22311",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 5.8,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:N",
          "authentication": "NONE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "MEDIUM",
          "availabilityImpact": "NONE",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 4.9,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 8.6,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV30": [
      {
        "type": "Secondary",
        "source": "psirt@us.ibm.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.0",
          "baseScore": 4.8,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N",
          "integrityImpact": "LOW",
          "userInteraction": "NONE",
          "attackComplexity": "HIGH",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 2.5,
        "exploitabilityScore": 2.2
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 6.5,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N",
          "integrityImpact": "LOW",
          "userInteraction": "NONE",
          "attackComplexity": "HIGH",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 4.2,
        "exploitabilityScore": 2.2
      }
    ]
  },
  "affected": [
    {
      "source": "psirt@us.ibm.com",
      "affectedData": [
        {
          "vendor": "IBM",
          "product": "Security Verify Access",
          "versions": [
            {
              "status": "affected",
              "version": "10.0.0"
            },
            {
              "status": "affected",
              "version": "10.0.1"
            },
            {
              "status": "affected",
              "version": "10.0.2"
            },
            {
              "status": "affected",
              "version": "10.0.3"
            }
          ]
        }
      ]
    }
  ],
  "published": "2022-03-31T18:15:09.437",
  "references": [
    {
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/217226",
      "tags": [
        "VDB Entry",
        "Vendor Advisory"
      ],
      "source": "psirt@us.ibm.com"
    },
    {
      "url": "https://www.ibm.com/support/pages/node/6568043",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "source": "psirt@us.ibm.com"
    },
    {
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/217226",
      "tags": [
        "VDB Entry",
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://www.ibm.com/support/pages/node/6568043",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-20"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "IBM Security Verify Access could allow a user, using man in the middle techniques, to obtain sensitive information or possibly change some information due to improper validiation of JWT tokens."
    },
    {
      "lang": "es",
      "value": "IBM Security Verify Access podría permitir a un usuario, usando técnicas de tipo man in the middle, obtener información confidencial o posiblemente cambiar alguna información debido a la comprobación inapropiada de los tokens JWT"
    }
  ],
  "lastModified": "2026-06-17T04:28:13.563",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:ibm:security_verify_access:10.0.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "7548DF30-5F20-4A0E-97B2-D33BEE9D4785"
            },
            {
              "criteria": "cpe:2.3:a:ibm:security_verify_access:10.0.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "BBC1ACEF-C524-49BE-B72A-9B7765090B01"
            },
            {
              "criteria": "cpe:2.3:a:ibm:security_verify_access:10.0.2:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "DE998672-F497-4D55-8370-9E4E81D15727"
            },
            {
              "criteria": "cpe:2.3:a:ibm:security_verify_access:10.0.3:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "2B372966-0DBE-4844-9364-9A1E8B70A4C9"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "psirt@us.ibm.com"
}