CVE-2022-33167lowCWE-1004

CVE-2022-33167: low-severity vulnerability in IBM Security Directory Integrator

IBM Security Directory Integrator information disclosure

Published · Updated

Follow this CVE+ Monitor Security Directory Integrator+ Monitor Security Verify Directory Integrator

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

8Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 3.7epss 0.4%
In short

IBM Security Directory Integrator fails to protect cookies with the HTTPOnly flag, allowing attackers to potentially steal sensitive information from cookies through client-side attacks.

Technical detail

The application does not set the HTTPOnly flag on cookies, enabling attackers to access cookie data via JavaScript or other client-side vectors. This affects IBM Security Directory Integrator 7.2.0 and IBM Security Verify Directory Integrator 10.0.0, potentially exposing authentication tokens or session identifiers.

Summary generated and translated by AI from the official description.
IBM Security Directory Integrator 7.2.0 and IBM Security Verify Directory Integrator 10.0.0 could allow a remote attacker to obtain sensitive information, caused by the failure to set the HTTPOnly flag. A remote attacker could exploit this vulnerability to obtain sensitive information from the cookie. IBM X-Force ID: 228587.
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
Affected products
IBM · Security Directory IntegratorIBM · Security Verify Directory Integrator
Related CVEs — IBM Security Directory Integrator

In the same product, most dangerous first.

CVE-2022-33164HIGHIBM Security Directory Server path traversalEPSS 1.5%CVE-2024-28767MEDIUMIBM Security Directory Integrator command executionEPSS 0.7%CVE-2022-33162HIGHIBM Directory Server buffer overflowEPSS 0.4%CVE-2024-28765MEDIUMSecurity vulnerability was found in IBM Security Directory IntegratorEPSS 0.4%CVE-2022-32759MEDIUMIBM Security Directory Server information disclosureEPSS 0.4%CVE-2024-28766LOWIBM Security Directory Integrator information disclosureEPSS 0.3%