CVE-2022-40234
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
0Exploited in Wild
-Decision
Descriptions
Versions of IBM Spectrum Protect Plus prior to 10.1.12 (excluding 10.1.12) include the private key information for a certificate inside the generated .crt file when uploading a TLS certificate to IBM Spectrum Protect Plus. If this generated .crt file is shared, an attacker can obtain the private key information for the uploaded certificate. IBM X-Force ID: 235718.
Las versiones de IBM Spectrum Protect Plus anteriores a 10.1.12 (excluyendo la 10.1.12) incluyen la información de la clave privada de un certificado dentro del archivo .crt generado cuando es descargado un certificado TLS en IBM Spectrum Protect Plus. Si este archivo .crt generado es compartido, un atacante puede obtener la información de la clave privada del certificado cargado. IBM X-Force ID: 235718
CVSS Scores
SSVC
- Decision:-
Timeline
- 2022-09-08 CVE Reserved
- 2022-09-19 CVE Published
- 2024-04-09 EPSS Updated
- 2024-09-16 CVE Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-668: Exposure of Resource to Wrong Sphere
CAPEC
References (2)
| URL | Tag | Source |
|---|
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|---|---|
| https://exchange.xforce.ibmcloud.com/vulnerabilities/235718 | 2022-09-21 | |
| https://www.ibm.com/support/pages/node/6619947 | 2022-09-21 |
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Ibm Search vendor "Ibm" | Spectrum Protect Plus Search vendor "Ibm" for product "Spectrum Protect Plus" | < 10.1.12 Search vendor "Ibm" for product "Spectrum Protect Plus" and version " < 10.1.12" | - |
Affected
| ||||||