Lucene search

IbmCVE-2021-39013

HistoryDec 22, 2021 - 5:15 p.m.

CVE-2021-39013

2021-12-2217:15:09

CWE-200

ibm

web.nvd.nist.gov

ibm

cloud pak

security

cp4s

vulnerability

information disclosure

http response

attack

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:S/C:P/I:N/A:N

CVSS3

6.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

AI Score

Confidence

High

EPSS

0.001

Percentile

23.7%

JSON

IBM Cloud Pak for Security (CP4S) 1.7.2.0, 1.7.1.0, and 1.7.0.0 could allow an authenticated user to obtain sensitive information in HTTP responses that could be used in further attacks against the system. IBM X-Force ID: 213651.

Affected configurations

Nvd

Vulners

Node

redhatopenshiftMatch-

AND

ibmcloud_pak_for_securityMatch1.7.0.0

ibmcloud_pak_for_securityMatch1.7.1.0

ibmcloud_pak_for_securityMatch1.7.2.0

VendorProductVersionCPE
redhatopenshift-cpe:2.3:a:redhat:openshift:-:*:*:*:*:*:*:*
ibmcloud_pak_for_security1.7.0.0cpe:2.3:a:ibm:cloud_pak_for_security:1.7.0.0:*:*:*:*:*:*:*
ibmcloud_pak_for_security1.7.1.0cpe:2.3:a:ibm:cloud_pak_for_security:1.7.1.0:*:*:*:*:*:*:*
ibmcloud_pak_for_security1.7.2.0cpe:2.3:a:ibm:cloud_pak_for_security:1.7.2.0:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
redhat	openshift	-	cpe:2.3:a:redhat:openshift:-:::::::*
ibm	cloud_pak_for_security	1.7.0.0	cpe:2.3:a:ibm:cloud_pak_for_security:1.7.0.0:::::::*
ibm	cloud_pak_for_security	1.7.1.0	cpe:2.3:a:ibm:cloud_pak_for_security:1.7.1.0:::::::*
ibm	cloud_pak_for_security	1.7.2.0	cpe:2.3:a:ibm:cloud_pak_for_security:1.7.2.0:::::::*

CNA Affected

[
  {
    "product": "Cloud Pak for Security",
    "vendor": "IBM",
    "versions": [
      {
        "status": "affected",
        "version": "1.7.0.0"
      },
      {
        "status": "affected",
        "version": "1.7.1.0"
      },
      {
        "status": "affected",
        "version": "1.7.2.0"
      }
    ]
  }
]

References

exchange.xforce.ibmcloud.com/vulnerabilities/213651

www.ibm.com/support/pages/node/6529200

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:S/C:P/I:N/A:N

CVSS3

6.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

AI Score

Confidence

High

EPSS

0.001

Percentile

23.7%

JSON

Related for CVE-2021-39013