CVE-2022-41296

MEDIUM 6.5

IBM Db2U cross-site respect forgery

CVSS Score

6.5

EPSS Score

0.0%

EPSS Percentile

0th

IBM Db2U 3.5, 4.0, and 4.5 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. IBM X-Force ID: 237210.

CWE	CWE-352
Vendor	ibm
Product	db2u
Published	Dec 1, 2022
Last Updated	Aug 3, 2024

Stay Ahead of the Next One

Get instant alerts for ibm db2u

Be the first to know when new medium vulnerabilities affecting ibm db2u are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

None

Affected Versions

IBM / Db2U

3.5, 4.0, 4.5

References

NVD ↗ CVE.org ↗ EPSS Data ↗

ibm.com: https://www.ibm.com/support/pages/node/6843071 exchange.xforce.ibmcloud.com: https://exchange.xforce.ibmcloud.com/vulnerabilities/237210 security.netapp.com: https://security.netapp.com/advisory/ntap-20230120-0003/