Security Bulletin: Information Disclosure in IBM Spectrum Protect Operations Center (CVE-2021-38901)

Summary

If tracing is enabled in Operations Center, user credentials may be displayed in the trace file in plain text.

Vulnerability Details

CVEID:CVE-2021-38901
**DESCRIPTION:**IBM Spectrum Protect Operations Center, under special configurations, could allow a local user to obtain highly sensitive information.
CVSS Base score: 5.1
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/209610 for the current score.
CVSS Vector: (CVSS:3.0/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N)

Affected Products and Versions

Remediation/Fixes

**Operations

IT38340

|

<https://www.ibm.com/support/pages/node/6518992&gt;

Workarounds and Mitigations

To minimize exposure to this vulnerability, do not turn on tracing unless instructed to do so by IBM and delete existing trace files that are no longer needed.