Security readout for executives and security teams
Plain-English summary
This is a low-severity IBM vulnerability involving sensitive information present in a source code repository for version 10.0. An attacker would need high privileges and difficult conditions, but the exposed information could help with later attacks if recovered.
Executive priority
Handle in normal vulnerability management cadence unless sensitive repository exposure is confirmed. Escalate if the affected product supports critical identity workflows, if many administrators have repository access, or if secrets are discovered during review.
Technical view
CVE-2022-22460 affects IBM Security Verify Identity Manager/Security Verify Governance 10.0 per the provided sources. The issue is information disclosure from sensitive data in a source code repository. CVSS 3.0 score is 3.0, with network attack vector, high privileges required, high complexity, and low confidentiality impact.
Likely exposure
Exposure is limited to organizations running the affected IBM 10.0 product and where a relevant source code repository or associated materials are accessible. The CVSS vector indicates high privileges are required, so ordinary unauthenticated internet exposure is not supported by the sources.
Exploitation context
The source bundle does not cite active exploitation. CISA KEV status is false, and the CVSS temporal metric lists exploit maturity as unproven. Treat this as a defense-in-depth issue that could aid follow-on attacks if sensitive information is found.
Researcher notes
The provided data has a naming inconsistency: the title says IBM Security Verify Identity Manager, while the affected product lists IBM Security Verify Governance. No CWE is supplied. The bundle does not include detailed patch identifiers, repository contents, or proof of exploitation.
Mitigation direction
- Review IBM advisory 6603405 and X-Force entry 225013 for vendor remediation details.
- Inventory IBM Security Verify Identity Manager/Governance 10.0 deployments.
- Restrict repository and deployment artifact access to required administrators only.
- Rotate secrets if internal review confirms exposed credentials or tokens.
- Apply IBM-provided fixes or configuration guidance once confirmed from vendor documentation.
Validation and detection
- Confirm whether version 10.0 of the affected IBM product is deployed.
- Review repository access controls and recent privileged access logs.
- Check IBM advisory and X-Force record for exact affected naming and remediation status.
- Assess whether sensitive values exist in relevant source or deployment repositories.
- Document whether any discovered secrets were rotated or invalidated.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2022-22460 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Low
- CVSS
- 3 (3.0)
- Known Exploited
- No
- Published
Vector: CVSS:3.0/AC:H/A:N/S:C/C:L/UI:N/AV:N/PR:H/I:N/RL:O/RC:C/E:U
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.0/AC:H/A:N/S:C/C:L/UI:N/AV:N/PR:H/I:N/RL:O/RC:C/E:U1.31.4Primary CVE scoreVulnerability scoring details
Base CVSS 3.0 score
3LowVector: CVSS:3.0/AC:H/A:N/S:C/C:L/UI:N/AV:N/PR:H/I:N/RL:O/RC:C/E:U
Source materials
- CVE List V5 sourceCVE List V5
- https://www.ibm.com/support/pages/node/6603405CVE reference · x_refsource_CONFIRM
- ibm-sv-cve202222460-info-disc (225013)CVE reference · vdb-entry, x_refsource_XF
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.