by Kastro
Paper/Archive/CVE-2022-22318

CVE-2022-22318

IBM Curam Social Program Management — IBM Curam Social Program Management 8.0.0 and 8.0.1 does not invalidate session after logout which could allow an authenticated user to i…

EPSS 0.4%CVSS 9.8
critical.is priorityof 100
37
CVSS 9.8 (NVD)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 39.2.392 × 207.8No public exploit+100.0SSVC exploitation: unknown+100.0
Description · from the CVE record

IBM Curam Social Program Management 8.0.0 and 8.0.1 does not invalidate session after logout which could allow an authenticated user to impersonate another user on the system.

Affected

ProductAffectedFixed inSource
Curam Social Program Management8.0.0–CNA
Curam Social Program Management8.0.1–CNA

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
ibm (CNA)5.9CVSS:3.0/PR:N/AV:L/A:L/I:L/S:U/AC:L/UI:N/C:L/E:U/RL:O/RC:C

References

refibm.com/support/pages/node/6596049refexchange.xforce.ibmcloud.com/vulnerabilities/218283