CVE-2022-40234
Medium
Description
Versions of IBM Spectrum Protect Plus prior to 10.1.12 (excluding 10.1.12) include the private key information for a certificate inside the generated .crt file when uploading a TLS certificate to IBM Spectrum Protect Plus. If this generated .crt file is shared, an attacker can obtain the private key information for the uploaded certificate. IBM X-Force ID: 235718.
SeverityMedium
CVSS5.9
Exploit probability—
Product
Ibm Spectrum Protect Plus
PublishedSep 19, 2022
First seenSep 19, 2022
How to fix
Update
- ibm spectrum_protect_plus10.1.12 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| ibm spectrum_protect_plus | v < 10.1.12 | 10.1.12 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.