CVE-2022-22326

LowCVSS 3.3/10Last modified Jun 17, 2026

Description

IBM Datapower Gateway 10.0.2.0 through 10.0.4.0, 10.0.1.0 through 10.0.1.5, and 2018.4.1.0 through 2018.4.1.18 could allow unauthorized viewing of logs and files due to insufficient authorization checks. IBM X-Force ID: 218856.

Metrics

CVSS 3.1 3.3/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-863

Affected software

Vendor	Product	Versions
IBM	DataPower Gateway	2018.4.1.0; 10.0.1.0; 10.0.2.0; 10.0.4.0; 2018.4.1.18; 10.1.0.5

References

https://exchange.xforce.ibmcloud.com/vulnerabilities/218856VDB Entry, Vendor Advisory
https://www.ibm.com/support/pages/node/6560048Patch, Vendor Advisory
https://www.ibm.com/support/pages/node/6608598Patch, Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/218856VDB Entry, Vendor Advisory
https://www.ibm.com/support/pages/node/6560048Patch, Vendor Advisory
https://www.ibm.com/support/pages/node/6608598Patch, Vendor Advisory

Timeline

Published: Aug 1, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-223277.5IBM UrbanCode Deploy (UCD) 7.0.5, 7.1.0, 7.1.1, and 7.1.2 uses weaker than expected cryptographic algorithms that could allow an attacker to CVE-2022-223286.2IBM SterlingPartner Engagement Manager 6.2.0 could allow a malicious user to elevate their privileges and perform unintended operations to a CVE-2022-223294.3IBM Control Desk 7.6.1 does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie CVE-2022-22338.8The Banner Cycler plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including 1.4. This is due to miss CVE-2022-223305.3IBM Control Desk 7.6.1 could allow a remote attacker to obtain sensitive information, caused by the failure to set the HTTPOnly flag. A remo CVE-2022-223317.1IBM SterlingPartner Engagement Manager 6.2.0 could allow a remote authenticated attacker to obtain sensitive information or modify user deta CVE-2022-223327.5IBM Sterling Partner Engagement Manager 6.2.0 could allow an attacker to impersonate another user due to missing revocation mechanism for th CVE-2022-223336.5IBM Sterling Secure Proxy 6.0.3.0, 6.0.2.0, and 3.4.3.2 and IBM Sterling External Authentication Server are vulnerable a buffer overflow, du CVE-2022-223344.3IBM Robotic Process Automation 21.0.0, 21.0.1, and 21.0.2 could allow a user to access information from a tenant of which they should not ha CVE-2022-223367.5IBM Sterling External Authentication Server and IBM Sterling Secure Proxy 6.0.3.0, 6.0.2.0, and 3.4.3.2 could allow a remote user to consume CVE-2022-223376.5IBM Sterling B2B Integrator Standard Edition 6.0.0.0 through 6.1.2.1 could disclose sensitive information to an authenticated user. IBM X-F CVE-2022-223389.8IBM Sterling B2B Integrator Standard Edition 6.0.0.0 through 6.1.2.1 is vulnerable to SQL injection. A remote attacker could send specially