CVE-2022-22494

Vulnerability

IBM Spectrum Protect Operations Center versions 8.1.0.000 through 8.1.14 are vulnerable to an information disclosure issue. A remote attacker can send a specially-crafted HTTP request that causes the application to return error messages containing database type and version details [1]. No authentication is required to trigger this condition.

Exploitation

An unauthenticated remote attacker can exploit this vulnerability by sending a crafted HTTP request to the affected server. The request triggers error responses that leak sensitive database metadata. The attack complexity is high (per CVSS vector), but no user interaction is required [1].

Impact

Successful exploitation allows the attacker to obtain the database type and version. This information has low direct confidentiality impact but can be leveraged to tailor further attacks against the database. The vulnerability does not allow modification or deletion of data [1].

Mitigation

As of the publication date, no fix is available. IBM has not released a patched version beyond 8.1.14 and no workarounds are documented [1]. Users should monitor IBM's security advisories for updates and consider network-level restrictions to limit exposure.