CVE-2019-4566 — Cleartext Storage of Sensitive Info in IBM Security KEY Lifecycle Manager

CWE-312 — Cleartext Storage of Sensitive Info3 documents3 sources
Severity
5.5MEDIUMNVD
EPSS
0.0%
top 94.22%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
IBM Security KEY Lifecycle Manager
Timeline
PublishedSep 24
Latest updateMay 24

Description

IBM Security Key Lifecycle Manager 3.0 and 3.0.1 stores user credentials in plain in clear text which can be read by a local user. IBM X-Force ID: 166627.

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:NExploitability: 1.8 | Impact: 3.6

Affected Packages2 packages

▶NVDibm/security_key_lifecycle_manager3.0 — 3.0.0.2+1
▶CVEListV5ibm/security_key_lifecycle_manager3.0, 3.0.1+1

Patches

Patch: www.ibm.com ↗Patch: www.ibm.com ↗

🔴Vulnerability Details

2
GHSA
GHSA-h32g-8m7h-6jhr: IBM Security Key Lifecycle Manager 3↗2022-05-24
▶
CVEList
CVE-2019-4566: IBM Security Key Lifecycle Manager 3↗2019-09-24
▶