Security Bulletin: Vulnerability in self-service console affects IBM Cloud Pak System (CVE-2021-20478)

2021-08-1213:54:09

www.ibm.com

ibm cloud pak system

self-service console

vulnerability

local user

upgrade

fixed release

EPSS

Percentile

5.1%

JSON

Summary

Vulnerability in self-sevice console affects IBM Cloud Pak System. IBM Cloud Pak System has addressed this vulnerability.

Vulnerability Details

CVEID:CVE-2021-20478
**DESCRIPTION:**IBM Cloud Pak System could allow a local user in some situations to view the artifacts of another user in self service console.
CVSS Base score: 4
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/197497 for the current score.
CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)

Affected Products and Versions

Affected Product(s)	Version(s)
IBM Cloud Pak System	V2.3.3.0 - V2.3.3.3

Remediation/Fixes

For unsupported release(s), recommendation is to upgrade to a supported fixed release of the product.

For IBM Cloud Pak System V2.3.3.1, V2.3.3.2, upgrade to IBM Cloud Pak System V2.3.3.3, and apply IBM Cloud Pak System V2.3.3.3 Interim Fix 1 from Fix Central.
For IBM Cloud Pak System V2.3.3.3, apply IBM Cloud Pak System V2.3.3.3 Interim Fix 1 from Fix Central.

Information on upgrading here: http://www.ibm.com/support/docview.wss?uid=ibm10887959.