CVE-2022-22326

Severity: low (CVSS 3.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2022-08-01 · updated 2026-06-17
Weakness: CWE-863

Description

IBM Datapower Gateway 10.0.2.0 through 10.0.4.0, 10.0.1.0 through 10.0.1.5, and 2018.4.1.0 through 2018.4.1.18 could allow unauthorized viewing of logs and files due to insufficient authorization checks. IBM X-Force ID: 218856.

Affected products

IBM DataPower Gateway 11.0.0: from 10.0.1.0 before 10.0.1.6; from 10.0.2.0 before 10.0.5.0; from 2018.4.1.0 before 2018.4.1.19 — fixed in 10.0.1.6, 10.0.5.0, 2018.4.1.19
IBM Mq Appliance M2001 Firmware: before 9.2.0.5; before 9.2.5 — fixed in 9.2.0.5, 9.2.5
IBM Mq Appliance M2002 Firmware: before 9.2.0.5; before 9.2.5 — fixed in 9.2.0.5, 9.2.5

How to fix

Upgrade to a fixed version: IBM DataPower Gateway 11.0.0 10.0.1.6, 10.0.5.0, 2018.4.1.19; IBM Mq Appliance M2001 Firmware 9.2.0.5, 9.2.5; IBM Mq Appliance M2002 Firmware 9.2.0.5, 9.2.5. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2022-22326 or the next vulnerability affects your stack