CVE-2022-22472

mediumpriority · track · 35EPSS 0.009 · 59 %ileDEEUUS

grimoire priorityP3 · Track

Exploitable?

—

no known exploitation

Likely / severe?

0.89% (59th) EPSS

CVSS 6.5 · medium

Is it mine?

9 products

Check your exposure

Who says so?

4 sources

cnnvd · enisa_euvd · cert_bund · nvd

EPSS · scored 2026-10-27

IBM Spectrum Protect Plus Container Backup and Restore (10.1.5 through 10.1.10.2 for Kubernetes and 10.1.7 through 10.1.10.2 for Red Hat OpenShift) could allow a remote attacker to bypass IBM Spectrum Protect Plus role based access control restrictions, caused by improper disclosure of session information. By retrieving the logs of a container an attacker could exploit this vulnerability to bypass login security of the IBM Spectrum Protect Plus server and gain unauthorized access based on the permissions of the IBM Spectrum Protect Plus user to the vulnerable Spectrum Protect Plus server software. IBM X-Force ID: 225340.

cvss

Technical severity, 0–10. One row per scoring source.

8.8

010

base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · medium–high · 6–8.8

v2.06.5mediumAV:N/AC:L/Au:S/C:P/I:P/A:Pprimary · NVD / NIST USexploitability 8 · impact 6.4

v3.18.8highCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:Hprimary · NVD / NIST USexploitability 2.8 · impact 5.9

v3.06mediumCVSS:3.0/I:L/UI:N/A:L/C:L/AC:H/S:C/AV:N/PR:L/RC:C/E:U/RL:Osecondary · ENISA EU

v3.06mediumCVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:Lsecondary · psirt@us.ibm.com USexploitability 1.8 · impact 3.7

v3.18.1highCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:Usecondary · CVSS-BT (t0sche)

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-281USprimary

affected products (9)

Products and version ranges known to be affected.

Amazon Linux 2all versionscert_bundDEcpe:/o:amazon:linux_2:-
IBM Spectrum Protect 10.1all versionscert_bundDEcpe:/a:ibm:spectrum_protect:10.1
IBM Spectrum Protect 8.1all versionscert_bundDEcpe:/a:ibm:spectrum_protect:8.1
Ubuntu Linuxall versionscert_bundDEcpe:/o:canonical:ubuntu_linux:-
IBM Spectrum Protect Plus≤ 10.1.5enisa_euvdEU
IBM Spectrum Protect Plus≤ 10.1.10.2enisa_euvdEU
IBM Spectrum Protect Plus≤ 10.1.7enisa_euvdEU
ibm spectrum protect plus container backup and restore10.1.5 → 10.1.11nvdUScpe:2.3:a:ibm:spectrum_protect_plus_container_backup_and_restore:*:*:*:*:*:*:*:*
ibm spectrum protect plus container backup and restore10.1.7 → 10.1.11nvdUScpe:2.3:a:ibm:spectrum_protect_plus_container_backup_and_restore:*:*:*:*:*:*:*:*

advisories (1)

Vendor and ecosystem advisories describing this.

WID-SEC-W-2022-0515IBM Spectrum Protect: Mehrere SchwachstellenDeutsch2022-06-29csaf · cert_bundDE
Ein entfernter, anonymer, authentisierter oder lokaler Angreifer kann mehrere Schwachstellen in IBM Spectrum Protect ausnutzen, um einen Denial-of-Service-Zustand herbeizuführen, Sicherheitsmaßnahmen zu umgehen, vertrauliche Informationen offenzulegen, beliebigen Code auszuführen, seine Rechte zu erweitern oder beliebigen Code mit Root-Rechten auszuführen.

also known as (3)

Other names and identifiers for this entity.

sources

Which sources assert this record, and when.

cnnvd enisa_euvd cert_bund nvd NVD CVE.org MITRE

published 2022-06-30modified 2026-06-17

related (402)

Related entries.

ID	severity	EPSS	exploitable	published
CVE-2022-0847US	high7.8OT critical	92.8% (100th)	KEV	2022-03-10
A flaw was found in the way the "flags" member of the new pipe buffer structure was lacking proper initialization in copy_page_to_iter_pipe and push_pipe functions in the Linux ker…
CVE-2017-8543US	critical9.8OT critical	74.4% (99th)	KEV	2017-06-15
Microsoft Windows XP SP3, Windows XP x64 XP2, Windows Server 2003 SP2, Windows Vista, Windows 7 SP1, Windows Server 2008 SP2 and R2 SP1, Windows 8, Windows 8.1 and Windows RT 8.1,…
CVE-2021-33990US	critical9.8	11.9% (96th)	Exploit	2023-04-16
Liferay Portal 6.2.5 allows Command=FileUpload&Type=File&CurrentFolder=/ requests when frmfolders.html exists. NOTE: The vendor disputes this issue because the exploit reference li…
CVE-2019-0233US	high7.5	66.1% (99th)	—	2020-09-14
An access permission override in Apache Struts 2.0.0 to 2.5.20 may cause a Denial of Service when performing a file upload.
CVE-2023-34034US	critical9.8	4.11% (91st)	Exploit	2023-07-19
Using "**" as a pattern in Spring Security configuration for WebFlux creates a mismatch in pattern matching between Spring Security and Spring WebFlux, and the potential for a se…

+397 more

references (8)

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan