What is the CVSS score of CVE-2022-22488?

CVE-2022-22488 has a CVSS 3.1 base score of 4.9 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.5%.

Power System Ac922 8335 Gtg Firmware CVE-2022-22488

MEDIUM

Allocation of Resources Without Limits or Throttling (CWE-770)

2022-12-12 psirt@us.ibm.com

IBM Denial Of Service Power System Ac922 8335 Gtg Firmware Power System Ac922 8335 Gth Firmware Power System Ac922 8335 Gtx Firmware

4.9

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

4.9 MEDIUM

AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

CVE Published

Dec 12, 2022 - 13:15 nvd

MEDIUM 4.9

DescriptionNVD

IBM OpenBMC OP910 and OP940 could allow a privileged user to cause a denial of service by uploading or deleting too many CA certificates in a short period of time. IBM X-Force ID: 2226337.

AnalysisAI

IBM OpenBMC OP910 and OP940 could allow a privileged user to cause a denial of service by uploading or deleting too many CA certificates in a short period of time. Rated medium severity (CVSS 4.9), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

Technical ContextAI

This vulnerability is classified as Allocation of Resources Without Limits (CWE-770), which allows attackers to exhaust system resources through uncontrolled allocation. IBM OpenBMC OP910 and OP940 could allow a privileged user to cause a denial of service by uploading or deleting too many CA certificates in a short period of time. IBM X-Force ID: 2226337. Affected products include: Ibm Power System Ac922 \(8335-Gtg\) Firmware, Ibm Power System Ac922 \(8335-Gth\) Firmware, Ibm Power System Ac922 \(8335-Gtx\) Firmware.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Set resource limits, implement rate limiting, validate input sizes.