What is CVE-2022-43860?

CVE-2022-43860 is a medium-severity vulnerability in IBM I, classified under SQL Injection. CVSS score: 4.3/10. Published 2022-12-24.

How severe is CVE-2022-43860?

Medium severity. CVSS v3 base score is 4.3 out of 10.

SQL Injection in IBM I

CVE-2022-43860

IBM Navigator for i 7.3, 7.4, and 7.5 could allow an authenticated user to obtain sensitive information they are authorized to but not while using this interface. By performing an SQL injection an attacker could see user profile attributes through this interface. IBM X-Force ID: 239305.

Vulnerability class: SQL Injection

EPSS: 0.005 (38.4th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 4.3 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N.

Affected products

Ibm I — versions 7.3, 7.4, 7.5
Ibm Navigator For I — versions 7.3, 7.4, 7.5

Weakness classification (CWE)

CWE-89 — SQL Injection

References

psirt@us.ibm.com (vendor-advisory, Patch, Vendor Advisory)
psirt@us.ibm.com (VDB Entry, vdb-entry, Vendor Advisory)

Frequently asked questions

What is CVE-2022-43860?: CVE-2022-43860 is a medium-severity vulnerability in IBM I, classified under SQL Injection. CVSS score: 4.3/10. Published 2022-12-24.
How severe is CVE-2022-43860?: Medium severity. CVSS v3 base score is 4.3 out of 10.