CVE-2022-43860: IBM Navigator for i SQL injection

Severity: medium (CVSS 4.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.5% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2022-12-24 · updated 2026-06-17
Weakness: CWE-89

Description

IBM Navigator for i 7.3, 7.4, and 7.5 could allow an authenticated user to obtain sensitive information they are authorized to but not while using this interface. By performing an SQL injection an attacker could see user profile attributes through this interface. IBM X-Force ID: 239305.

Affected products

IBM i: 7.3, 7.4, 7.5

References

https://exchange.xforce.ibmcloud.com/vulnerabilities/239305
https://www.ibm.com/support/pages/node/6850801
https://exchange.xforce.ibmcloud.com/vulnerabilities/239305
https://www.ibm.com/support/pages/node/6850801

Get alerted when CVE-2022-43860 or the next vulnerability affects your stack