Vulnerability CVE-2019-4259


Published: 2019-05-13

Description:
A security vulnerability has been identified in IBM Spectrum Scale 4.1.1, 4.2.0, 4.2.1, 4.2.2, 4.2.3, and 5.0.0 with CES stack enabled that could allow sensitive data to be included with service snaps. IBM X-Force ID: 160011.

Type:

CWE-200

(Information Exposure)

Vendor: IBM
Product: Spectrum scale 
Version:
5.0.2.3
5.0.2.2
5.0.2.1
5.0.2.0
5.0.1.2
5.0.1.1
5.0.1.0
5.0.0.2
5.0.0.1
5.0.0.0
4.2.3.9
4.2.3.8
4.2.3.7
4.2.3.6
4.2.3.5
4.2.3.4
4.2.3.3
4.2.3.2
4.2.3.13
4.2.3.12
4.2.3.11
4.2.3.10
4.2.3.1
4.2.3.0
4.2.2.0
4.2.1
4.2.0.4
4.2.0.3
4.2.0.2
4.2.0.1
4.2.0.0
4.1.1.9
4.1.1.8
4.1.1.7
4.1.1.6
4.1.1.5
4.1.1.4
4.1.1.3
4.1.1.22
4.1.1.21
4.1.1.20
4.1.1.2
4.1.1.19
4.1.1.18
4.1.1.17
4.1.1.16
4.1.1.15
4.1.1.14
4.1.1.13
4.1.1.12
4.1.1.11
4.1.1.10
4.1.1.1
4.1.1.0

CVSS2 => (AV:L/AC:L/Au:N/C:P/I:N/A:N)

CVSS Base Score
Impact Subscore
Exploitability Subscore
2.1/10
2.9/10
3.9/10
Exploit range
Attack complexity
Authentication
Local
Low
No required
Confidentiality impact
Integrity impact
Availability impact
Partial
None
None

 References:
https://exchange.xforce.ibmcloud.com/vulnerabilities/160011
https://www.ibm.com/support/docview.wss?uid=ibm10883568

Related CVE
CVE-2019-4265
IBM Maximo Anywhere 7.6.0, 7.6.1, 7.6.2, and 7.6.3 does not have device root detection which could result in an attacker gaining sensitive information about the device. IBM X-Force ID: 160198.
CVE-2019-4558
A security vulnerability has been identified in all levels of IBM Spectrum Scale V5.0.0.0 through V5.0.3.2 and IBM Spectrum Scale V4.2.0.0 through V4.2.3.17 that could allow a local attacker to obtain root privilege by injecting parameters into setui...
CVE-2019-4512
IBM Maximo Asset Management 7.6.1.1 generates an error message that includes sensitive information that could be used in further attacks against the system. IBM X-Force ID: 164554.
CVE-2019-4564
IBM Security Key Lifecycle Manager 2.6, 2.7, 3.0, and 3.0.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to creden...
CVE-2019-4514
IBM Security Key Lifecycle Manager 2.6, 2.7, 3.0, and 3.0.1 discloses sensitive information to unauthorized users. The information can be used to mount further attacks on the system. IBM X-Force ID: 165136.
CVE-2019-4227
IBM MQ 8.0.0.4 - 8.0.0.12, 9.0.0.0 - 9.0.0.6, 9.1.0.0 - 9.1.0.2, and 9.1.0 - 9.1.2 AMQP Listeners could allow an unauthorized user to conduct a session fixation attack due to clients not being disconnected as they should. IBM X-Force ID: 159352.
CVE-2019-4441
IBM WebSphere Application Server 7.0, 8.0, 8.5, 9.0, and Liberty could allow a remote attacker to obtain sensitive information when a stack trace is returned in the browser. IBM X-Force ID: 163177.
CVE-2019-4422
IBM Security Guardium 9.0, 9.5, and 10.6 are vulnerable to a privilege escalation which could allow an authenticated user to change the accessmgr password. IBM X-Force ID: 162768.

Copyright 2019, cxsecurity.com

 

Back to Top