CVE-2022-43915

IBM App Connect Enterprise Certified Container 5.0, 7.1, 7.2, 8.0, 8.1, 8.2, 9.0, 9.1, 9.2, 10.0, 10.1, 11.0, 11.1, 11.2, 11.3, 11.4, 11.5, 11.6, 12.0, and 12.1 does not limit calls to unshare in running Pods. This can allow a user with privileged access to execute commands in a running Pod to elevate their user privileges.

CVSS v3 8.1 HIGH

8.1^/10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 5.2

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://exchange.xforce.ibmcloud.com/vulnerabilities/241037	VDB Entry Vendor Advisory
https://www.ibm.com/support/pages/node/7166463	Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:ibm:app_connect_enterprise_certified_container:5.0::::lts:::
	cpe:2.3:a:ibm:app_connect_enterprise_certified_container:7.1:::::::*
	cpe:2.3:a:ibm:app_connect_enterprise_certified_container:7.2:::::::*
	cpe:2.3:a:ibm:app_connect_enterprise_certified_container:8.0:::::::*
	cpe:2.3:a:ibm:app_connect_enterprise_certified_container:8.1:::::::*
	cpe:2.3:a:ibm:app_connect_enterprise_certified_container:8.2:::::::*
	cpe:2.3:a:ibm:app_connect_enterprise_certified_container:9.0:::::::*
	cpe:2.3:a:ibm:app_connect_enterprise_certified_container:9.1:::::::*
	cpe:2.3:a:ibm:app_connect_enterprise_certified_container:9.2:::::::*
	cpe:2.3:a:ibm:app_connect_enterprise_certified_container:10.0:::::::*
	cpe:2.3:a:ibm:app_connect_enterprise_certified_container:10.1:::::::*
	cpe:2.3:a:ibm:app_connect_enterprise_certified_container:11.0:::::::*
	cpe:2.3:a:ibm:app_connect_enterprise_certified_container:11.1:::::::*
	cpe:2.3:a:ibm:app_connect_enterprise_certified_container:11.2:::::::*
	cpe:2.3:a:ibm:app_connect_enterprise_certified_container:11.3:::::::*
	cpe:2.3:a:ibm:app_connect_enterprise_certified_container:11.4:::::::*
	cpe:2.3:a:ibm:app_connect_enterprise_certified_container:11.5:::::::*
	cpe:2.3:a:ibm:app_connect_enterprise_certified_container:11.6:::::::*
	cpe:2.3:a:ibm:app_connect_enterprise_certified_container:12.0::::lts:::
	cpe:2.3:a:ibm:app_connect_enterprise_certified_container:12.1:::::::*

History

21 Sep 2024, 10:15

Type	Values Removed	Values Added
Summary	(en) IBM App Connect Enterprise Certified Container 5.0, 7.1, 7.2, 8.0, 8.1, 8.2, 9.0, 9.1, 9.2, 10.0, 10.1, 11.0, 11.1, 11.2, 11.3, 11.4, 11.5, 11.6, 12.0, and 12.1 does not limit calls to unshare in running Pods. This can allow a user with access to execute commands in a running Pod to elevate their user privileges.	(en) IBM App Connect Enterprise Certified Container 5.0, 7.1, 7.2, 8.0, 8.1, 8.2, 9.0, 9.1, 9.2, 10.0, 10.1, 11.0, 11.1, 11.2, 11.3, 11.4, 11.5, 11.6, 12.0, and 12.1 does not limit calls to unshare in running Pods. This can allow a user with privileged access to execute commands in a running Pod to elevate their user privileges.

27 Aug 2024, 15:30

Type	Values Removed	Values Added
First Time		Ibm app Connect Enterprise Certified Container Ibm
References	~~() https://exchange.xforce.ibmcloud.com/vulnerabilities/241037 -~~	() https://exchange.xforce.ibmcloud.com/vulnerabilities/241037 - VDB Entry, Vendor Advisory
References	~~() https://www.ibm.com/support/pages/node/7166463 -~~	() https://www.ibm.com/support/pages/node/7166463 - Vendor Advisory
CVSS	v2 : ~~unknown~~ v3 : ~~6.8~~	v2 : unknown v3 : 8.1
CPE		cpe:2.3:a:ibm:app_connect_enterprise_certified_container:8.1:::::::* cpe:2.3:a:ibm:app_connect_enterprise_certified_container:12.0::::lts::: cpe:2.3:a:ibm:app_connect_enterprise_certified_container:10.0:::::::* cpe:2.3:a:ibm:app_connect_enterprise_certified_container:11.5:::::::* cpe:2.3:a:ibm:app_connect_enterprise_certified_container:8.0:::::::* cpe:2.3:a:ibm:app_connect_enterprise_certified_container:8.2:::::::* cpe:2.3:a:ibm:app_connect_enterprise_certified_container:11.4:::::::* cpe:2.3:a:ibm:app_connect_enterprise_certified_container:11.1:::::::* cpe:2.3:a:ibm:app_connect_enterprise_certified_container:10.1:::::::* cpe:2.3:a:ibm:app_connect_enterprise_certified_container:9.0:::::::* cpe:2.3:a:ibm:app_connect_enterprise_certified_container:9.1:::::::* cpe:2.3:a:ibm:app_connect_enterprise_certified_container:9.2:::::::* cpe:2.3:a:ibm:app_connect_enterprise_certified_container:12.1:::::::* cpe:2.3:a:ibm:app_connect_enterprise_certified_container:11.0:::::::* cpe:2.3:a:ibm:app_connect_enterprise_certified_container:5.0::::lts::: cpe:2.3:a:ibm:app_connect_enterprise_certified_container:11.2:::::::* cpe:2.3:a:ibm:app_connect_enterprise_certified_container:7.2:::::::* cpe:2.3:a:ibm:app_connect_enterprise_certified_container:7.1:::::::* cpe:2.3:a:ibm:app_connect_enterprise_certified_container:11.6:::::::* cpe:2.3:a:ibm:app_connect_enterprise_certified_container:11.3:::::::*

26 Aug 2024, 12:47

Type	Values Removed	Values Added
Summary		(es) IBM App Connect Enterprise Certified Container 5.0, 7.1, 7.2, 8.0, 8.1, 8.2, 9.0, 9.1, 9.2, 10.0, 10.1, 11.0, 11.1, 11.2, 11.3, 11.4, 11.5, 11.6, 12.0 y 12.1 no limita las llamadas para dejar de compartir en Pods en ejecución. Esto puede permitir que un usuario con acceso para ejecutar comandos en un Pod en ejecución aumente sus privilegios de usuario.

24 Aug 2024, 12:15

Type	Values Removed	Values Added
New CVE

Information

Published : 2024-08-24 12:15

Updated : 2024-09-21 10:15

NVD link : CVE-2022-43915

Mitre link : CVE-2022-43915

CVE.ORG link : CVE-2022-43915

JSON object : View

Products Affected

ibm

app_connect_enterprise_certified_container

CWE

CWE-732

Incorrect Permission Assignment for Critical Resource

8.1 /10