## Summary

A vulnerability in Apache Tomcat affects the product’s management GUI. The Command Line Interface is unaffected.

## Vulnerability Details

**CVEID: **[CVE-2022-25762]()
**DESCRIPTION: **Apache Tomcat could allow a remote attacker to bypass security restrictions, caused by improper error handling in WebSocket connection. By sending a specially-crafted WebSocket message concurrently with the WebSocket connection closing, an attacker could exploit this vulnerability to continue to use the socket after it has been closed.
CVSS Base score: 8.6
CVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/226498]() for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L)

## Affected Products and Versions

Affected Product(s) | Version(s)
—|—
IBM Spectrum Virtualize | 8.4
IBM Spectrum Virtualize | 8.5

Note that this applies to all IBM SAN Volume Controller, IBM Storwize and IBM FlashSystem products which run IBM Spectrum Virtualize software.

## Remediation/Fixes

IBM recommends that you fix this vulnerability by upgrading affected versions of IBM SAN Volume Controller, IBM Storwize V7000, IBM Storwize V5000 and V5100, IBM Storwize V5000E, IBM Spectrum Virtualize Software, IBM Spectrum Virtualize for Public Cloud, IBM FlashSystem V9000, IBM FlashSystem 9500, IBM FlashSystem 9100 Family, IBM FlashSystem 9200, IBM FlashSystem 7300, IBM FlashSystem 7200, IBM FlashSystem 5200 and IBM FlashSystem 5000 to the following code levels or higher:

8.5.2.0

8.5.0.5

8.4.0.7

[Latest IBM SAN Volume Controller Code]()
[Latest IBM Storwize V7000 Code]()
[Latest IBM Storwize V5000 and V5100 Code]()
[Latest IBM Storwize V5000E Code]()
[Latest IBM FlashSystem V9000 Code]()
[Latest IBM FlashSystem 9500 Code]( “” )
[Latest IBM FlashSystem 9100 Family Code]( “” )
[Latest IBM FlashSystem 9200 Code]( “” )
[Latest IBM FlashSystem 7300 Code]( “” )
[Latest IBM FlashSystem 7200 Code]( “” )
[Latest IBM FlashSystem 5000 and 5200 Code]( “” )
[Latest IBM Spectrum Virtualize Software]()
[Latest IBM Spectrum Virtualize for Public Cloud]()

## Workarounds and Mitigations

None

## Get Notified about Future Security Bulletins

Subscribe to [My Notifications]() to be notified of important product support alerts like this.

### References

[Complete CVSS v3 Guide]( “Link resides outside of ibm.com” )
[On-line Calculator v3]( “Link resides outside of ibm.com” )

Off

## Related Information

[IBM Secure Engineering Web Portal]()
[IBM Product Security Incident Response Blog]()

## Change History

20 Sep 2022: Initial Publication

*The CVSS Environment Score is customer environment specific and will ultimately impact the Overall CVSS Score. Customers can evaluate the impact of this vulnerability in their environments by accessing the links in the Reference section of this Security Bulletin.

## Disclaimer

Review the [IBM security bulletin disclaimer and definitions]() regarding your responsibilities for assessing potential impact of security vulnerabilities to your environment.

## Document Location

Worldwide

[{“Business Unit”:{“code”:”BU054″,”label”:”Systems w/TPS”},”Product”:{“code”:”STHGUL”,”label”:”IBM Storwize V5000E”},”Component”:””,”Platform”:[{“code”:”PF004″,”label”:”Appliance”}],”Version”:”8.5, 8.4″,”Edition”:””},{“Business Unit”:{“code”:”BU054″,”label”:”Systems w/TPS”},”Product”:{“code”:”ST3FR3″,”label”:”IBM FlashSystem 7200″},”Component”:””,”Platform”:[{“code”:”PF004″,”label”:”Appliance”}],”Version”:”8.5, 8.4″,”Edition”:””,”Line of Business”:{“code”:”LOB26″,”label”:”Storage”}},{“Business Unit”:{“code”:”BU054″,”label”:”Systems w/TPS”},”Product”:{“code”:”ST3FR7″,”label”:”IBM Storwize V7000 (2076)”},”Component”:””,”Platform”:[{“code”:”PF004″,”label”:”Appliance”}],”Version”:”8.5, 8.4″,”Edition”:””},{“Business Unit”:{“code”:”BU058″,”label”:”IBM Infrastructure w/TPS”},”Product”:{“code”:”SSV1DQD”,”label”:”IBM FlashSystem 7300″},”Component”:””,”Platform”:[{“code”:”PF004″,”label”:”Appliance”}],”Version”:”8.5, 8.4″,”Edition”:””,”Line of Business”:{“code”:”LOB26″,”label”:”Storage”}},{“Business Unit”:{“code”:”BU054″,”label”:”Systems w/TPS”},”Product”:{“code”:”STSLR9″,”label”:”IBM FlashSystem 9100 family”},”Component”:””,”Platform”:[{“code”:”PF004″,”label”:”Appliance”}],”Version”:”8.5, 8.4″,”Edition”:””,”Line of Business”:{“code”:”LOB26″,”label”:”Storage”}},{“Business Unit”:{“code”:”BU054″,”label”:”Systems w/TPS”},”Product”:{“code”:”STKMQV”,”label”:”IBM FlashSystem V9000″},”Component”:””,”Platform”:[{“code”:”PF004″,”label”:”Appliance”}],”Version”:”8.5, 8.4″,”Edition”:””,”Line of Business”:{“code”:”LOB26″,”label”:”Storage”}},{“Business Unit”:{“code”:”BU054″,”label”:”Systems w/TPS”},”Product”:{“code”:”ST3FR9″,”label”:”IBM FlashSystem 5000″},”Component”:””,”Platform”:[{“code”:”PF004″,”label”:”Appliance”}],”Version”:”8.5, 8.4″,”Edition”:””,”Line of Business”:{“code”:”LOB26″,”label”:”Storage”}},{“Business Unit”:{“code”:”BU010″,”label”:”Systems – Storage”},”Product”:{“code”:”STVLF4″,”label”:”IBM Spectrum Virtualize software”},”Component”:””,”Platform”:[{“code”:”PF004″,”label”:”Appliance”}],”Version”:”8.5, 8.4″,”Edition”:””},{“Business Unit”:{“code”:”BU054″,”label”:”Systems w/TPS”},”Product”:{“code”:”STHGUJ”,”label”:”IBM Storwize V5000 and V5100″},”Component”:””,”Platform”:[{“code”:”PF004″,”label”:”Appliance”}],”Version”:”8.5, 8.4″,”Edition”:””},{“Business Unit”:{“code”:”BU058″,”label”:”IBM Infrastructure w/TPS”},”Product”:{“code”:”SSRFRYE”,”label”:”IBM FlashSystem 9500″},”Component”:””,”Platform”:[{“code”:”PF004″,”label”:”Appliance”}],”Version”:”8.5, 8.4″,”Edition”:””,”Line of Business”:{“code”:”LOB26″,”label”:”Storage”}},{“Business Unit”:{“code”:”BU058″,”label”:”IBM Infrastructure w/TPS”},”Product”:{“code”:”ST3FS7″,”label”:”IBM FlashSystem 9200″},”Component”:””,”Platform”:[{“code”:”PF004″,”label”:”Appliance”}],”Version”:”8.5, 8.4″,”Edition”:””,”Line of Business”:{“code”:”LOB26″,”label”:”Storage”}},{“Business Unit”:{“code”:”BU010″,”label”:”Systems – Storage”},”Product”:{“code”:”SSVMX8″,”label”:”IBM Spectrum Virtualize for Public Cloud”},”Component”:””,”Platform”:[{“code”:”PF004″,”label”:”Appliance”}],”Version”:”8.5, 8.4″,”Edition”:””},{“Business Unit”:{“code”:”BU058″,”label”:”IBM Infrastructure w/TPS”},”Product”:{“code”:”STPVGU”,”label”:”SAN Volume Controller”},”Component”:””,”Platform”:[{“code”:”PF004″,”label”:”Appliance”}],”Version”:”8.5, 8.4″,”Edition”:””,”Line of Business”:{“code”:”LOB26″,”label”:”Storage”}}]Read More