High severity · published Apr 7, 2023
CVE-2022-34333
IBM Sterling Order Management 10.0 does not require that users should have strong passwords by default, which makes it easier for attackers to compromise user accounts
7.5
CVSS
0.6%
EPSS
No
On KEV
Description
IBM Sterling Order Management 10.0 does not require that users should have strong passwords by default, which makes it easier for attackers to compromise user accounts. IBM X-Force ID: 229698.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.6% · higher than 48% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SO
Sterling Order Management · Ibm
10 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2022-34333
CVE.org
https://www.cve.org/CVERecord?id=CVE-2022-34333
VDB Entry
https://exchange.xforce.ibmcloud.com/vulnerabilities/229698
Vendor Advisory
https://www.ibm.com/support/pages/node/6981917
More from Sterling Order Management
8.1
CVE-2022-33959
IBM Sterling Order Management 10.0 could allow a user to bypass validation and perform unauthorized actions on behalf of other users
6.1
CVE-2021-20554
IBM Sterling Order Management 9.4, 9.5, and 10.0 is vulnerable to cross-site scripting
–
CVE-2015-1911
Cross-site scripting (XSS) vulnerability in Sterling Order Management 8.5 before HF113, Sterling Selling and Fulfillment Foundation 9.0.0 before FP92, and Sterling Field Sales…
–
CVE-2014-0932
Cross-site scripting (XSS) vulnerability in IBM Sterling Order Management 8.5 before HF105 and Sterling Selling and Fulfillment Foundation 9.0 before HF85 allows remote…