IBM CICS TX information disclosure

Vulnerability

IBM CICS TX Advanced and Standard version 11.1 use weaker than expected cryptographic algorithms [1][2]. This vulnerability (CVE-2022-34319) allows an attacker to decrypt highly sensitive information. The affected products are IBM CICS TX Advanced 11.1 and IBM CICS TX Standard 11.1.

Exploitation

An unauthenticated attacker with network access can exploit this weakness. The CVSS vector indicates high attack complexity (AC:H) but no privileges or user interaction required [1][2]. The exact exploitation steps are not detailed, but the attacker would likely intercept encrypted data and leverage weak ciphers to decrypt it.

Impact

Successful exploitation results in the disclosure of highly sensitive information, compromising confidentiality. The CVSS score is 5.9 with high confidentiality impact and no impact on integrity or availability [1][2].

Mitigation

IBM has released fixes for both affected products. For IBM CICS TX Advanced 11.1 and IBM CICS TX Standard 11.1, download and apply the interim fix from IBM's support page [1][2]. No workarounds are available.