CVE-2022-38383
📋 TL;DR
This vulnerability allows web pages to be stored locally in IBM Cloud Pak for Security and IBM QRadar Software Suite, which can then be read by other users on the same system. It affects IBM Cloud Pak for Security versions 1.10.0.0 through 1.10.11.0 and IBM QRadar Software Suite versions 1.10.12.0 through 1.10.21.0. The issue stems from improper web page storage that lacks proper access controls.
💻 Affected Systems
- IBM Cloud Pak for Security
- IBM QRadar Software Suite
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Sensitive information from locally stored web pages could be accessed by unauthorized users on the same system, potentially exposing configuration data, session information, or other sensitive content.
Likely Case
Local users with access to the system could read web pages containing potentially sensitive information that should be restricted.
If Mitigated
With proper access controls and user separation, the impact is limited to information disclosure within controlled environments.
🎯 Exploit Status
Exploitation requires local access to the system where the affected software is installed. The vulnerability involves reading locally stored files that should be protected.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: IBM Cloud Pak for Security 1.10.12.0 and later; IBM QRadar Software Suite 1.10.22.0 and later
Vendor Advisory: https://www.ibm.com/support/pages/node/7158986
Restart Required: Yes
Instructions:
1. Download the latest version from IBM Fix Central. 2. Follow IBM's upgrade documentation for your specific product. 3. Apply the update following IBM's deployment procedures. 4. Restart the application/services as required.
🔧 Temporary Workarounds
Restrict Local User Access
allLimit local user access to systems running affected software to only authorized administrators.
Implement strict access controls using your operating system's user/group permissions
File Permission Hardening
allReview and tighten file permissions on web page storage directories to prevent unauthorized reading.
Review file permissions in application directories and restrict to necessary users only
🧯 If You Can't Patch
- Implement strict access controls to limit which users can access the affected systems
- Monitor for unusual file access patterns and implement additional logging for web page storage directories
🔍 How to Verify
Check if Vulnerable:
Check the installed version of IBM Cloud Pak for Security or IBM QRadar Software Suite against the affected version ranges.Check Version:
Check product documentation for version verification commands specific to your deployment.Verify Fix Applied:
Verify the installed version is IBM Cloud Pak for Security 1.10.12.0+ or IBM QRadar Software Suite 1.10.22.0+.📡 Detection & Monitoring
Log Indicators:
- Unusual file access patterns to web page storage directories
- Multiple failed access attempts to protected files
Network Indicators:
- Not applicable - this is a local vulnerability
SIEM Query:
Look for file access events in application directories by non-privileged users or unusual access patterns.