IBM Sterling B2B Integrator 6.x Session Invalidation Flaw (CVE-2022-22371)
CVE-2022-22371 Published on January 5, 2023

IBM Sterling B2B Integrator Standard Edition session fixation
IBM Sterling B2B Integrator Standard Edition 6.0.0.0 through 6.1.2.1 does not invalidate session after a password change which could allow an authenticated user to impersonate another user on the system. IBM X-Force ID: 221195.

Vendor Advisory NVD

Vulnerability Analysis

Attack Vector:
ADJACENT_NETWORK
Attack Complexity:
LOW
Privileges Required:
LOW
User Interaction:
NONE
Scope:
UNCHANGED
Confidentiality Impact:
LOW
Integrity Impact:
LOW
Availability Impact:
LOW

Weakness Type

Insufficient Session Expiration

According to WASC, "Insufficient Session Expiration is when a web site permits an attacker to reuse old session credentials or session IDs for authorization."


Products Associated with CVE-2022-22371

Want to know whenever a new CVE is published for IBM Sterling B2b Integrator? stack.watch will email you.

IBM Sterling B2b Integrator
 

Affected Versions

IBM Sterling B2B Integrator Standard Edition:

Exploit Probability

EPSS
0.13%
Percentile
31.81%

EPSS (Exploit Prediction Scoring System) scores estimate the probability that a vulnerability will be exploited in the wild within the next 30 days. The percentile shows you how this score compares to all other vulnerabilities.