Sensitive Information Disclosure in IBM Control Desk by IBM
CVE-2022-22330

3.7LOW

Key Information:

Vendor
IBM
Status
Control Desk
Vendor
CVE Published:
12 September 2022

Summary

IBM Control Desk 7.6.1 is susceptible to a vulnerability that enables remote attackers to access sensitive information due to a failure to set the HTTPOnly flag. This oversight allows malicious actors to exploit cookie data, potentially leading to unauthorized information retrieval. Protection against this kind of information leakage is crucial for maintaining data integrity and user trust.

Affected Version(s)

Control Desk 7.6.1

References

https://www.ibm.com/support/pages/node/6619739
x_refsource_CONFIRM
https://exchange.xforce.ibmcloud.com/vulnerabilities/219126
vdb-entryx_refsource_XF

CVSS V3.1

Score:
3.7
Severity:
LOW
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.