November 19, 2023
Severity High Analysis Summary The STOP/DJVU ransomware initially made headlines in 2018 and has since been attacking individuals all around the world. It’s widespread on torrent […]
Rewterz Threat Alert – STOP (DJVU) Ransomware – Active IOCs
January 6, 2023
Rewterz Threat Advisory – Multiple IBM Robotic Process Automation Vulnerabilities
January 6, 2023
Rewterz Threat Alert – STOP (DJVU) Ransomware – Active IOCs
January 6, 2023
Rewterz Threat Advisory – Multiple IBM Robotic Process Automation Vulnerabilities
January 6, 2023
Severity
Medium
Analysis Summary
CVE-2022-43920 CVSS:6.3
IBM Sterling B2B Integrator Standard Edition 6.0.0.0 through 6.1.2.1 could allow an authenticated user to gain privileges in a different group due to an access control vulnerability in the Sftp server adapter.
CVE-2022-34330 CVSS:6.1
IBM Sterling B2B Integrator Standard Edition 6.0.0.0 through 6.1.2.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.
CVE-2022-22371 CVSS:5.5
IBM Sterling B2B Integrator Standard Edition 6.0.0.0 through 6.1.2.1 does not invalidate session after a password change which could allow an authenticated user to impersonate another user on the system.
CVE-2022-22352 CVSS:5.4
IBM Sterling B2B Integrator Standard Edition 6.0.0.0 through 6.1.2.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.
CVE-2022-22338 CVSS:6.3
IBM Sterling B2B Integrator Standard Edition 6.0.0.0 through 6.1.2.1 is vulnerable to SQL injection. A remote attacker could send specially crafted SQL statements, which could allow the attacker to view, add, modify or delete information in the back-end database.
CVE-2022-22337 CVSS:4.3
IBM Sterling B2B Integrator Standard Edition 6.0.0.0 through 6.1.2.1 could disclose sensitive information to an authenticated user.
CVE-2021-38928 CVSS:5.4
IBM Sterling B2B Integrator Standard Edition 6.0.0.0 through 6.1.2.1 uses Cross-Origin Resource Sharing (CORS) which could allow an attacker to carry out privileged actions and retrieve sensitive information as the domain name is not being limited to only trusted domains.
Impact
- Privilege Escalation
- Cross-Site Scripting
- Data Manipulation
- Information Disclosure
- Information Theft
Indicators Of Compromise
CVE
- CVE-2022-43920
- CVE-2022-34330
- CVE-2022-22371
- CVE-2022-22352
- CVE-2022-22338
- CVE-2022-22337
- CVE-2021-38928
Affected Vendors
IBM
Affected Products
- IBM Sterling B2B Integrator 6.0.0.0
- IBM Sterling B2B Integrator 6.0.3.6
- IBM Sterling B2B Integrator 6.1.0.0
- IBM Sterling B2B Integrator 6.1.1.0
- IBM Sterling B2B Integrator 6.1.2.0
- IBM Sterling B2B Integrator 6.1.1.2
Remediation
Refer to IBM Security Advisory for patch, upgrade or suggested workaround information.