← Back

CVE-2022-40228

nvd nist
Published: Nov 22, 2022Modified: Jun 17, 2026

JSON object

Loading...
5.4
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Exploitability: 2.8 / Impact: 2.5
Source: NVD

Description

IBM DataPower Gateway 10.0.3.0 through 10.0.4.0, 10.0.1.0 through 10.0.1.9, 2018.4.1.0 through 2018.4.1.22, and 10.5.0.0 through 10.5.0.2 does not invalidate session after a password change which could allow an authenticated user to impersonate another user on the system. IBM X-Force ID: 235527.

Affected (4)

Ibm
1 product
Datapower Gateway
Configuration A
4 vulnerable
Vulnerable SoftwareAffected Versions
Ibm
Datapower Gateway
From 10.0.1.0 to 10.0.1.9
Datapower Gateway
From 10.0.3.0 to 10.0.4.0
Datapower Gateway
From 10.5.0.0 to 10.5.0.2
Datapower Gateway
From 2018.4.1.0 to 2018.4.1.22

Related CWEs

CWE-613
Insufficient Session Expiration
According to WASC, "Insufficient Session Expiration is when a web site permits an attacker to reuse old session credentials or session IDs for authorization."

References (4)

Source: psirt@us.ibm.com
VDB EntryVendor Advisory
Source: psirt@us.ibm.com
Vendor Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
VDB EntryVendor Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Vendor Advisory

Timeline

No history available yet.