CVE-2022-34314

Vulnerability

IBM CICS TX Advanced version 11.1 and IBM CICS TX Standard version 11.1 are vulnerable to information disclosure due to insecure permission settings [1], [2]. This allows a local user to access sensitive information that should be protected.

Exploitation

An attacker must have local access to the system. No authentication or user interaction is required (CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) [1], [2]. The attacker can exploit the insecure permissions to read sensitive files or data.

Impact

Successful exploitation leads to disclosure of sensitive information (confidentiality impact: low). The attack does not affect integrity or availability [1], [2]. The CVSS base score is 4.0 [1], [2].

Mitigation

IBM has released fixes for both affected products. For IBM CICS TX Advanced 11.1, download the fix from the IBM support page (defect 127954). For IBM CICS TX Standard 11.1, also download the fix from the IBM support page (defect 127954). No workarounds are available [1], [2]. The fix was made available prior to the publication date of 31 Oct 2022.