CVE-2022-22318

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

IBM Curam Social Program Management 8.0.0 and 8.0.1 does not invalidate session after logout which could allow an authenticated user to impersonate another user on the system.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-613

Affected software

Vendor	Product	Versions
IBM	Curam Social Program Management	8.0.0; 8.0.1

References

https://exchange.xforce.ibmcloud.com/vulnerabilities/218283VDB Entry, Vendor Advisory
https://www.ibm.com/support/pages/node/6596049Patch, Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/218283VDB Entry, Vendor Advisory
https://www.ibm.com/support/pages/node/6596049Patch, Vendor Advisory

Timeline

Published: Jun 20, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-223195.4IBM Robotic Process Automation 21.0.1 could allow a register user on the system to physically delete a queue that could cause disruption for CVE-2022-22327.5A flaw was found in the Keycloak package. This flaw allows an attacker to utilize an LDAP injection to bypass the username lookup or potenti CVE-2022-223204.8IBM QRadar SIEM 7.3 and 7.4 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the CVE-2022-223215.5IBM MQ Appliance 9.2 CD and 9.2 LTS local messaging users stored with a password hash that provides insufficient protection. IBM X-Force ID:CVE-2022-223225.4IBM InfoSphere Information Server 11.7 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript CVE-2022-223236.5IBM Security Identity Manager (IBM Security Verify Password Synchronization Plug-in for Windows AD 10.x) is vulnerable to a denial of servic CVE-2022-223255.5IBM MQ (IBM MQ for HPE NonStop 8.1.0) can inadvertently disclose sensitive information under certain circumstances to a local user from a st CVE-2022-223263.3IBM Datapower Gateway 10.0.2.0 through 10.0.4.0, 10.0.1.0 through 10.0.1.5, and 2018.4.1.0 through 2018.4.1.18 could allow unauthorized view CVE-2022-223277.5IBM UrbanCode Deploy (UCD) 7.0.5, 7.1.0, 7.1.1, and 7.1.2 uses weaker than expected cryptographic algorithms that could allow an attacker to CVE-2022-223286.2IBM SterlingPartner Engagement Manager 6.2.0 could allow a malicious user to elevate their privileges and perform unintended operations to a CVE-2022-223294.3IBM Control Desk 7.6.1 does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie CVE-2022-22338.8The Banner Cycler plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including 1.4. This is due to miss