CVE-2022-22425

"IBM InfoSphere Information Server 11.7 is potentially vulnerable to CSV Injection. A remote...

9.8 Critical

"IBM InfoSphere Information Server 11.7 is potentially vulnerable to CSV Injection. A remote attacker could execute arbitrary commands on the system, caused by improper validation of csv file contents. IBM X-Force ID: 223598."

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: High
Integrity: High
Availability: High

Exploit likelihood

1.30%Up 0.2 points since Nov 4, 2022

What each source reports

NVD Score used 9.8

Record: CVE-2022-22425
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-1236
Updated: 2026-11-02

CVE List 9.8

Record: CVE-2022-22425
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-1236
Updated: 2026-11-02

EUVDEUVD-2022-27571 9.8

Record: EUVD-2022-27571
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

GitHub AdvisoriesGHSA-g5qw-hp88-696m 9.8

"IBM InfoSphere Information Server 11.7 is potentially vulnerable to CSV Injection. A remote...

Record: GHSA-g5qw-hp88-696m
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-1236
Updated: 2026-11-02

Affected products

ibm infosphere information server

History

History
Recorded	Changed	Sources
Nov 2, 2026	first indexed	CVE List, EUVD, GitHub Advisories, NVD

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2022-22425 is a critical vulnerability (CVSS 9.8) in Ibm Infosphere Information Server, published November 3, 2022. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.30%, the 70th percentile. No source names a fixed version.