PT-2018-14155 · Ibm · Ibm Spectrum Protect Plus

Published 2018-09-26 · Updated 2019-10-09 · CVE-2018-1768

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions IBM Spectrum Protect Plus versions 10.1.0 through 10.1.1

Description The issue could disclose sensitive information when an authorized user executes a test operation. The user id and password may be displayed in plain text within an instrumentation log file.

Recommendations For versions 10.1.0 and 10.1.1, consider restricting access to the instrumentation log file to minimize the risk of sensitive information disclosure until a fix is available.

Fix

Insertion into Log File

Weakness Enumeration

CWE-532

Related Identifiers

CVE-2018-1768

Affected Products

Ibm Spectrum Protect Plus

References · 5

• https://exchange.xforce.ibmcloud.com/vulnerabilities/148622 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-1768 · Security Note
• https://osv.dev/vulnerability/CVE-2018-1768 · Vendor Advisory
• http://ibm.com/support/docview.wss?uid=ibm10729219 · Vendor Advisory
• http://securitytracker.com/id/1041715 · Note