Lucene search

IBMB8E0ADC989FC2E5FDB4DA729EB4BCB801C50C639E7E4DF0044EE6F141727F218

HistoryJun 29, 2022 - 2:05 p.m.

Security Bulletin: IBM Cloud Pak for Multicloud Management Monitoring runs containers with excessive permissions (CVE-2021-38941)

2022-06-2914:05:28

www.ibm.com

ibm cloudpak

multicloud monitoring

containers

privileged mode

vulnerability

host information leakage

arbitrary commands

upgrade

fix pack

CVSS2

5.5

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:L/Au:S/C:P/I:P/A:N

CVSS3

8.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

EPSS

0.001

Percentile

23.3%

JSON

Summary

IBM CloudPak for Multicloud Monitoring had a few containers running in priviliged mode which is vulnerable to host information leakage or destruction if unauthorized access to these containers could execute arbitrary commands. Now only containers requiring this permissions are running in priviliged mode.

Vulnerability Details

CVEID:CVE-2021-38941
**DESCRIPTION:**IBM CloudPak for Multicloud Monitoring has a few containers running in priviliged mode which is vulnerable to host information leakage or destruction if unauthorized access to these containers could execute arbitrary commands.
CVSS Base score: 5.3
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/211048 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N)

Affected Products and Versions

Affected Product(s)	Version(s)
IBM Cloud Pak for Multicloud Management Monitoring	2.0 - 2.3 Fix Pack 4

Remediation/Fixes

IBM strongly recommends addressing the vulnerability now by upgrading using the instructions found at <https://www.ibm.com/docs/en/cloud-paks/cp-management/2.3.x?topic=installation-upgrade.>

Workarounds and Mitigations

None

Affected configurations

Vulners

Node

ibmcloud_pak_for_multicloud_managementMatch2.3

VendorProductVersionCPE
ibmcloud_pak_for_multicloud_management2.3cpe:2.3:a:ibm:cloud_pak_for_multicloud_management:2.3:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
ibm	cloud_pak_for_multicloud_management	2.3	cpe:2.3:a:ibm:cloud_pak_for_multicloud_management:2.3:::::::*

CVSS2

5.5

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:L/Au:S/C:P/I:P/A:N

CVSS3

8.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

EPSS

0.001

Percentile

23.3%

JSON

Related for B8E0ADC989FC2E5FDB4DA729EB4BCB801C50C639E7E4DF0044EE6F141727F218