CVE-2022-43858: IBM Navigator for i information disclosure

Severity: medium (CVSS 4.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.1% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2022-12-22 · updated 2026-06-17
Weakness: CWE-22

Description

IBM Navigator for i 7.3, 7.4, and 7.5 could allow an authenticated user to access the file system and download files they are authorized to but not while using this interface. The remote authenticated user can bypass the interface checks by modifying a parameter thereby gaining access to their files through this interface. IBM X-Force ID: 239303.

Affected products

IBM i: 7.3, 7.4, 7.5

References

https://exchange.xforce.ibmcloud.com/vulnerabilities/239303
https://www.ibm.com/support/pages/node/6850801
https://exchange.xforce.ibmcloud.com/vulnerabilities/239303
https://www.ibm.com/support/pages/node/6850801

Get alerted when CVE-2022-43858 or the next vulnerability affects your stack