{"id":"CVE-2022-40230","state":"PUBLISHED","title":"\"IBM MQ Appliance 9.2 CD, 9.2 LTS, 9.3 CD, and LTS 9.3 does not invalidate session after logout which could allow an authenticated user to impersonate another user on the system. I","description":"\"IBM MQ Appliance 9.2 CD, 9.2 LTS, 9.3 CD, and LTS 9.3 does not invalidate session after logout which could allow an authenticated user to impersonate another user on the system. IBM X-Force ID: 235532.\"","publishedAt":"2022-11-03T00:00:00.000Z","updatedAt":"2025-05-02T20:13:28.518Z","severity":{"score":6.5,"label":"Medium","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","source":"CISA-ADP"},"assigner":"ibm","products":["n/a IBM MQ Appliance "],"affected":[{"vendor":"n/a","product":"IBM MQ Appliance ","versions":[{"version":"\"9.2 CD, 9.2 LTS, 9.3 CD, and LTS 9.3\"","status":"affected"}]}],"references":["https://www.ibm.com/support/pages/node/6622051"],"weaknesses":["CWE-613"],"ingestedAt":"2026-10-29T19:50:35.280Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2022/40xxx/CVE-2022-40230.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.1","cveMetadata":{"cveId":"CVE-2022-40230","state":"PUBLISHED","datePublished":"2022-11-03T00:00:00.000Z","dateUpdated":"2025-05-02T20:13:28.518Z","assignerShortName":"ibm","assignerOrgId":"9a959283-ebb5-44b6-b705-dcc2bbced522","dateReserved":"2022-09-08T00:00:00.000Z"},"containers":{"cna":{"descriptions":[{"lang":"en","value":"\"IBM MQ Appliance 9.2 CD, 9.2 LTS, 9.3 CD, and LTS 9.3 does not invalidate session after logout which could allow an authenticated user to impersonate another user on the system. IBM X-Force ID: 235532.\""}],"affected":[{"vendor":"n/a","product":"IBM MQ Appliance ","versions":[{"version":"\"9.2 CD, 9.2 LTS, 9.3 CD, and LTS 9.3\"","status":"affected"}]}],"references":[{"url":"https://www.ibm.com/support/pages/node/6622051"}],"problemTypes":[{"descriptions":[{"type":"text","lang":"en","description":"Session Fixation"}]}],"providerMetadata":{"shortName":"ibm","orgId":"9a959283-ebb5-44b6-b705-dcc2bbced522","dateUpdated":"2022-11-03T00:00:00.000Z"}},"adp":[{"title":"CVE Program Container","references":[{"url":"https://www.ibm.com/support/pages/node/6622051","tags":["x_transferred"]}],"providerMetadata":{"shortName":"CVE","orgId":"af854a3a-2127-422b-91ae-364da2661108","dateUpdated":"2024-08-03T12:14:40.041Z"}},{"title":"CISA ADP Vulnrichment","metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":6.5,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"LOW","confidentialityImpact":"NONE"}},{"other":{"type":"ssvc","content":{"timestamp":"2025-05-02T20:12:44.152482Z","id":"CVE-2022-40230","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-613","type":"CWE","lang":"en","description":"CWE-613 Insufficient Session Expiration"}]}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2025-05-02T20:13:28.518Z"}}]}}}