Security Bulletin: User passwords might be obtained by a brute force attack on IBM® Intelligent Operations Center (CVE-2019-4067)

Summary

If your IBM® Intelligent Operations Center system is configured to use a Lightweight Directory Access Protocol (LDAP) user registry, user passwords might be obtained by a brute force attack that uses HTTP basic authentication requests to IBM Intelligent Operations Center.

Vulnerability Details

CVEID: CVE-2019-4067 DESCRIPTION: IBM Intelligent Operations Center does not require that users should have strong passwords by default, which makes it easier for attackers to compromise user accounts.
CVSS Base Score: 5.9
CVSS Temporal Score: See <https://exchange.xforce.ibmcloud.com/vulnerabilities/157012&gt; for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N)

Affected Products and Versions

This vulnerability affects the following products and versions:

• IBM® Intelligent Operations Center V5.1.0 - V5.2.0
• IBM® Intelligent Operations Center for Emergency Management V5.1.0 - V5.1.0.6
• IBM® Water Operations for Waternamics V5.1.0 - V5.2.1.1

Remediation/Fixes

Workarounds and Mitigations

Ensure that your LDAP server is configured with a suitable Password Policy. For more information, see the troubleshooting document: User passwords might be obtained by a brute force attack on IBM® Intelligent Operations Center if your LDAP server does not have a secure Password Policy.