CVE-2021-39019

2022-07-1417:15:08

CWE-200

[email protected]

web.nvd.nist.gov

ibm

engineering lifecycle optimization

publishing

sensitive info

disclosure

http get

authenticated user

CVSS3

6.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

EPSS

0.001

Percentile

23.7%

JSON

IBM Engineering Lifecycle Optimization - Publishing 6.0.6, 6.0.6.1, 7.0, 7.0.1, and 7.0.2 could disclose highly sensitive information through an HTTP GET request to an authenticated user. IBM X-Force ID: 213728.

Affected configurations

Nvd

Node

ibmengineering_lifecycle_optimization_publishingMatch6.0.6

ibmengineering_lifecycle_optimization_publishingMatch6.0.6.1

ibmengineering_lifecycle_optimization_publishingMatch7.0

ibmengineering_lifecycle_optimization_publishingMatch7.0.1

ibmengineering_lifecycle_optimization_publishingMatch7.0.2

AND

linuxlinux_kernelMatch-

microsoftwindowsMatch-

VendorProductVersionCPE
ibmengineering_lifecycle_optimization_publishing6.0.6cpe:2.3:a:ibm:engineering_lifecycle_optimization_publishing:6.0.6:*:*:*:*:*:*:*
ibmengineering_lifecycle_optimization_publishing6.0.6.1cpe:2.3:a:ibm:engineering_lifecycle_optimization_publishing:6.0.6.1:*:*:*:*:*:*:*
ibmengineering_lifecycle_optimization_publishing7.0cpe:2.3:a:ibm:engineering_lifecycle_optimization_publishing:7.0:*:*:*:*:*:*:*
ibmengineering_lifecycle_optimization_publishing7.0.1cpe:2.3:a:ibm:engineering_lifecycle_optimization_publishing:7.0.1:*:*:*:*:*:*:*
ibmengineering_lifecycle_optimization_publishing7.0.2cpe:2.3:a:ibm:engineering_lifecycle_optimization_publishing:7.0.2:*:*:*:*:*:*:*
linuxlinux_kernel-cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*
microsoftwindows-cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
ibm	engineering_lifecycle_optimization_publishing	6.0.6	cpe:2.3:a:ibm:engineering_lifecycle_optimization_publishing:6.0.6:::::::*
ibm	engineering_lifecycle_optimization_publishing	6.0.6.1	cpe:2.3:a:ibm:engineering_lifecycle_optimization_publishing:6.0.6.1:::::::*
ibm	engineering_lifecycle_optimization_publishing	7.0	cpe:2.3:a:ibm:engineering_lifecycle_optimization_publishing:7.0:::::::*
ibm	engineering_lifecycle_optimization_publishing	7.0.1	cpe:2.3:a:ibm:engineering_lifecycle_optimization_publishing:7.0.1:::::::*
ibm	engineering_lifecycle_optimization_publishing	7.0.2	cpe:2.3:a:ibm:engineering_lifecycle_optimization_publishing:7.0.2:::::::*
linux	linux_kernel	-	cpe:2.3:o:linux:linux_kernel:-:::::::*
microsoft	windows	-	cpe:2.3:o:microsoft:windows:-:::::::*