CVE-2022-22426

Vulnerability

IBM Spectrum Copy Data Management Admin versions 2.2.0.0 through 2.2.15.0 are affected by a vulnerability in session management. The lack of proper session handling allows a local attacker to bypass authentication restrictions and gain unauthorized access to the Spectrum Copy Data Management catalog, which contains metadata [1].

Exploitation

An attacker with local access to the system can exploit this vulnerability without any authentication or user interaction. The attack complexity is high, as it requires local access and knowledge of the session management flaw [1]. The exact exploitation steps are not detailed in the available references, but the vulnerability is triggered by the absence of proper session validation.

Impact

Successful exploitation allows the attacker to bypass authentication and access the Spectrum Copy Data Management catalog, leading to unauthorized disclosure of metadata. The confidentiality impact is low, and there is no impact on integrity or availability [1].

Mitigation

IBM has released a fix for this vulnerability. Users should upgrade to IBM Spectrum Copy Data Management Admin version 2.2.16.0 or later as specified in the security bulletin [1]. No workarounds are documented.