CVE-2022-43920

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

IBM Sterling B2B Integrator Standard Edition 6.0.0.0 through 6.1.2.1 could allow an authenticated user to gain privileges in a different group due to an access control vulnerability in the Sftp server adapter. IBM X-Force ID: 241362.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected software

Vendor	Product	Versions
IBM	Sterling B2B Integrator Standard Edition	>= 6.0.0.0, < 6.1.2.1

References

https://exchange.xforce.ibmcloud.com/vulnerabilities/241362VDB Entry, Vendor Advisory
https://www.ibm.com/support/pages/node/6852465Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/241362VDB Entry, Vendor Advisory
https://www.ibm.com/support/pages/node/6852465Vendor Advisory

Timeline

Published: Jan 4, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-439226.5IBM App Connect Enterprise Certified Container 4.1, 4.2, 5.0, 5.1, 5.2, 6.0, 6.1, and 6.2 could disclose sensitive information to an attacke CVE-2022-439235.5IBM Maximo Application Suite 8.8.0 and 8.9.0 stores potentially sensitive information that could be read by a local user. IBM X-Force ID: CVE-2022-439277.5IBM Db2 for Linux, UNIX and Windows 10.5, 11.1, and 11.5 is vulnerable to information Disclosure due to improper privilege management when a CVE-2022-439286.5The IBM Toolbox for Java (Db2 Mirror for i 7.4 and 7.5) could allow a user to obtain sensitive information, caused by utilizing a Java strin CVE-2022-439297.5IBM Db2 for Linux, UNIX and Windows 11.1 and 11.5 may be vulnerable to a Denial of Service when executing a specially crafted 'Load' command CVE-2022-43935.4The ImageLinks Interactive Image Builder for WordPress plugin through 1.5.3 does not sanitise and escape some of its settings, which could a CVE-2022-439307.5IBM Db2 for Linux, UNIX and Windows 10.5, 11.1, and 11.5 is vulnerable to an Information Disclosure as sensitive information may be included CVE-2022-4393110.0Out-of-bounds write vulnerability in Remote Desktop Functionality in Synology VPN Plus Server before 1.4.3-0534 and 1.4.4-0635 allows remote CVE-2022-439327.5Improper neutralization of special elements in output used by a downstream component ('Injection') vulnerability in CGI component in Synolog CVE-2022-439334.4An information exposure through log file vulnerability exists in Brocade SANnav before Brocade SANnav 2.2.2, where configuration secrets are CVE-2022-439347.5Brocade SANnav before Brocade SANnav 2.2.2 supports key exchange algorithms, which are considered weak on ports 24, 6514, 18023, 19094, and CVE-2022-439354.4An information exposure through log file vulnerability exists in Brocade SANnav before Brocade SANnav 2.2.2, where Brocade Fabric OS Switch