Medium severity · published Oct 6, 2023
CVE-2022-34355
IBM Jazz Foundation information disclosure
5.5
CVSS
0.2%
EPSS
No
On KEV
Description
IBM Jazz Foundation (IBM Engineering Lifecycle Management 6.0.6, 6.0.6.1, 7.0, 7.0.1, and 7.0.2) could disclose sensitive version information to a user that could be used in further attacks against the system. IBM X-Force ID: 230498.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Attack vector
Local
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 9% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
EL
Engineering Lifecycle Management · IBM
6.0.6, 6.0.6.1, 7.0, 7.0.1, 7.0.2 · source: vendor, NVD
CL
Collaborative Lifecycle Management · Ibm
6.0.6; 6.0.6.1 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2022-34355
CVE.org
https://www.cve.org/CVERecord?id=CVE-2022-34355
VDB Entry
https://exchange.xforce.ibmcloud.com/vulnerabilities/230498
Vendor Advisory
https://www.ibm.com/support/pages/node/7046995
More from Engineering Lifecycle Management
9.8
CVE-2026-3660
IBM Engineering Lifecycle Management - Jazz Foundation is vulnerable to Authentication Bypass
8.8
CVE-2020-4495
IBM Jazz Foundation and IBM Engineering products could allow a remote attacker to bypass security restrictions, caused by improper access control
7.5
CVE-2026-14979
IBM Engineering Lifecycle Management - Jazz Foundation is vulnerable to XML Entity Expansion attack
7.5
CVE-2020-4965
IBM Jazz Team Server products use weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information
7.2
CVE-2026-4051
IBM Engineering Lifecycle Management - Jazz Foundation is vulnerable to Server Post-Auth Remote Code Execution