CVE-2022-22353

EUVD-2022-27499
IBM Big SQL on IBM Cloud Pak for Data 7.1.0, 7.1.1, 7.2.0, and 7.2.3 could allow an authenticated user with appropriate permissions to obtain sensitive information by bypassing data masking rules using a CREATE TABLE SELECT statement. IBM X-Force ID: 220480.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
6.5 MEDIUM
NETWORK
LOW
LOW
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
ibmCNA
5.3 MEDIUM
NETWORK
HIGH
LOW
CVSS:3.0/AV:N/A:N/C:H/AC:H/PR:L/S:U/I:N/UI:N/RC:C/E:U/RL:O
Base Score
CVSS 3.x
EPSS Score
Percentile: 33%
Affected Products (NVD)
VendorProductVersion
ibmbig_sql
7.1.0
ibmbig_sql
7.1.1
ibmbig_sql
7.2.0 ≤
𝑥
≤ 7.2.3
ibmbig_sql
7.2.3
𝑥
= Vulnerable software versions
References
https://exchange.xforce.ibmcloud.com/vulnerabilities/220480
https://www.ibm.com/support/pages/node/6563021
https://exchange.xforce.ibmcloud.com/vulnerabilities/220480
https://www.ibm.com/support/pages/node/6563021