PT-2018-1933 · Ibm · Ibm Cloud Private

Publicado 2018-11-19 · Atualizado 2019-10-09 · CVE-2018-1843

Positive Technologies (AI Summary)

CVSS v3.1

4.1

Média

Vetor base

AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions IBM Cloud Private version 3.1.0

Description The issue is related to the Identity and Access Management (IAM) services not using a secure channel, such as SSL, to exchange information when accessed internally from within the cluster. This could allow an attacker with access to network traffic to intercept packets from the connection and uncover sensitive data. The vulnerability is caused by a lack of encryption measures for protected data, which could enable an attacker to disclose sensitive information.

Recommendations For IBM Cloud Private version 3.1.0, consider implementing SSL encryption for internal connections to prevent data interception. As a temporary workaround, restrict access to the IAM services to minimize the risk of exploitation.

Correção

Missing Encryption of Sensitive Data

Information Disclosure

Enumeração de Fraquezas

CWE-311

CWE-200

Identificadores relacionados

BDU:2018-01540

CVE-2018-1843

Produtos afetados

Ibm Cloud Private

Referências · 7

• https://www-01.ibm.com/support/docview.wss?uid=ibm10739845 · Nota
• https://bdu.fstec.ru/vul/2018-01540 · Nota de Segurança
• https://nvd.nist.gov/vuln/detail/CVE-2018-1843 · Nota de Segurança
• https://exchange.xforce.ibmcloud.com/vulnerabilities/150903 · Aviso do Fabricante
• https://cxsecurity.com/cveshow/CVE-2018-1843/; · Nota
• https://osv.dev/vulnerability/CVE-2018-1843 · Aviso do Fabricante
• http://ibm.com/support/docview.wss?uid=ibm10739845 · Aviso do Fabricante