CVE-2019-4398 — Files or Directories Accessible to External Parties in IBM Cloud Orchestrator

CWE-552 — Files or Directories Accessible to External PartiesCWE-311 — Missing Encryption of Sensitive Data3 documents3 sources
Severity
3.3LOWNVD
EPSS
0.1%
top 75.30%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
IBM Cloud OrchestratorIBM Cloud Orchestrator Enterprise
Timeline
PublishedOct 24
Latest updateMay 24

Description

IBM Cloud Orchestrator and IBM Cloud Orchestrator Enterprise 2.5 through 2.5.0.9 and 2.4 through 2.4.0.5 could allow a local user to obtain sensitive information from SessionManagement cookies. IBM X-Force ID: 162259.

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:NExploitability: 1.8 | Impact: 1.4

Affected Packages3 packages

▶NVDibm/cloud_orchestrator_enterprise2.4 — 2.4.0.5+1
▶NVDibm/cloud_orchestrator2.4 — 2.4.0.5+1
▶CVEListV5ibm/cloud_orchestrator16 versions+15

Patches

Patch: www.ibm.com ↗Patch: www.ibm.com ↗

🔴Vulnerability Details

2
GHSA
GHSA-2hv5-gqgx-ppf5: IBM Cloud Orchestrator and IBM Cloud Orchestrator Enterprise 2↗2022-05-24
▶
CVEList
CVE-2019-4398: IBM Cloud Orchestrator and IBM Cloud Orchestrator Enterprise 2↗2019-10-24
▶
CVE-2019-4398 — IBM Cloud Orchestrator vulnerability | cvebase