IBM Security Dir Server 6.4.0 HSTS Misconfig Remote Info Disclosure
CVE-2022-33161 Published on October 14, 2023

IBM Security Directory Server information disclosure
IBM Security Directory Server 6.4.0 could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable HTTP Strict Transport Security. An attacker could exploit this vulnerability to obtain sensitive information using man in the middle techniques. X-Force ID: 228569.

Vendor Advisory Vendor Advisory NVD

Vulnerability Analysis

CVE-2022-33161 can be exploited with network access, requires user interaction. This vulnerability is consided to have a high level of attack complexity. The potential impact of an exploit of this vulnerability is considered to have a high impact on confidentiality, with no impact on integrity and availability.

Attack Vector:
NETWORK
Attack Complexity:
HIGH
Privileges Required:
NONE
User Interaction:
REQUIRED
Scope:
UNCHANGED
Confidentiality Impact:
HIGH
Integrity Impact:
NONE
Availability Impact:
NONE

Weakness Type

Missing Encryption of Sensitive Data

The software does not encrypt sensitive or critical information before storage or transmission. The lack of proper data encryption passes up the guarantees of confidentiality, integrity, and accountability that properly implemented encryption conveys.


Products Associated with CVE-2022-33161

You can be notified by email with stack.watch whenever vulnerabilities like CVE-2022-33161 are published in these products:

IBM Security Directory Server
 
IBM Security Directory Integrator
 
IBM Security Verify Directory
 
IBM Security Directory Suite
 

Affected Versions

IBM Security Directory Server Version 6.4.0 is affected by CVE-2022-33161

Exploit Probability

EPSS
0.02%
Percentile
5.65%

EPSS (Exploit Prediction Scoring System) scores estimate the probability that a vulnerability will be exploited in the wild within the next 30 days. The percentile shows you how this score compares to all other vulnerabilities.