CVE-2022-22346

Vulnerability

IBM Spectrum Protect Operations Center versions 8.1.0.000 through 8.1.13.xxx are vulnerable to cross-site request forgery (CSRF). An attacker can leverage this vulnerability to execute malicious and unauthorized actions transmitted from a user that the website trusts. [1]

Exploitation

An attacker needs to craft a malicious request and trick an authenticated user into clicking a link or visiting a page that triggers the request. No special privileges are required beyond user interaction. The attacker can then perform state-changing operations on behalf of the victim. [1]

Impact

Successful exploitation leads to unauthorized actions with the privileges of the victim user. According to the CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N), the impact is low integrity, with no confidentiality or availability impact. The attacker could potentially modify settings or perform actions within the Operations Center. [1]

Mitigation

IBM has released fixes; refer to the security bulletin for details. No workarounds are available. Users should apply the latest fix pack for version 8.1.13 or upgrade to a newer version. [1]