Analysis Summary

CVE-2024-22326 CVSS:5

IBM System Storage DS8900F 89.22.19.0, 89.30.68.0, 89.32.40.0, 89.33.48.0, 89.40.83.0, and 89.40.93.0 could allow a remote user to create an LDAP connection with a valid username and empty password to establish an anonymous connection.

CVE-2023-45192 CVSS:8.2

IBM Engineering Requirements Management DOORS Next 7.0.2 and 7.0.3 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources.

CVE-2022-35718 CVSS:3.7

IBM Sterling Partner Engagement Manager 6.2.3 stores sensitive information in URL parameters. This may lead to information disclosure if unauthorized parties have access to the URLs via server logs, referrer header or browser history.

Impact

• Security Bypass
• Information Obtain

Indicators of Compromise

CVE

• CVE-2024-22326
• CVE-2023-45192
• CVE-2022-35718

Affected Vendors

Remediation

Refer to IBM Security Advisory for patch, upgrade or suggested workaround information.

CVE-2024-22326

CVE-2023-45192

CVE-2022-35718