by Kastro
Paper/Archive/CVE-2022-22317

CVE-2022-22317

IBM Curam Social Program Management — IBM Curam Social Program Management 8.0.0 and 8.0.1 does not invalidate session after logout which could allow an authenticated user to i…

EPSS 0.5%CVSS 9.8
critical.is priorityof 100
38
CVSS 9.8 (NVD)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 44.5.445 × 208.9No public exploit+100.0SSVC exploitation: unknown+100.0
Description · from the CVE record

IBM Curam Social Program Management 8.0.0 and 8.0.1 does not invalidate session after logout which could allow an authenticated user to impersonate another user on the system. IBM X-Force ID: 218281.

Affected

ProductAffectedFixed inSource
Curam Social Program Management8.0.0–CNA
Curam Social Program Management8.0.1–CNA

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
ibm (CNA)5.9CVSS:3.0/C:L/AC:L/UI:N/S:U/I:L/A:L/AV:L/PR:N/RL:O/RC:C/E:U

References

refibm.com/support/pages/node/6596049refexchange.xforce.ibmcloud.com/vulnerabilities/218281