Cyber Resilience

CVE-2022-34314

MediumLPE

Published: 14 November 2022

Published
14 November 2022
Modified
21 November 2024
KEV Added
Patch
CVSS Score v3.1 4.0 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
EPSS Score 0.0012 30.9th percentile
Risk Priority 8 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2022-34314 is a medium-severity Exposure of Sensitive Information to an Unauthorized Actor (CWE-200) vulnerability in Ibm Cics Tx. Its CVSS base score is 4.0 (Medium).

Operationally, ranked at the 30.9th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

EU & UK References

Vulnerability details

IBM CICS TX 11.1 could disclose sensitive information to a local user due to insecure permission settings. IBM X-Force ID: 229450.

CWE(s)

Related Threats

No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.

Affected Assets

ibm
cics tx
11.1

Mitigating Controls

Likely Mitigating Controls AI

Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.

addresses: CWE-200 CWE-732

Proper attribute retention and permitted-value enforcement limits unauthorized actors from accessing sensitive information lacking correct labels.

addresses: CWE-732 CWE-200

Audit logs and logging tools are critical resources whose protection requires correct permission assignments to block unauthorized actions.

addresses: CWE-200 CWE-732

Documenting information locations and authorized users enables better protection against unauthorized exposure of sensitive data.

addresses: CWE-732 CWE-200

Places configuration items under formal management, enforcing correct permission assignments on critical resources.

addresses: CWE-200 CWE-732

Requiring equivalent controls at the alternate storage site prevents unauthorized exposure of sensitive backup data.

addresses: CWE-200 CWE-732

Protecting confidentiality of backup information prevents unauthorized exposure of sensitive data stored in backups.

addresses: CWE-200 CWE-732

Assessing control effectiveness and providing incident communication channels at alternate sites reduces the likelihood of sensitive information exposure to unauthorized actors.

addresses: CWE-200 CWE-732

Requiring protection of the program plan from unauthorized disclosure directly reduces exposure of sensitive security program details and control descriptions.

References