PT-2018-1933 · Ibm · Ibm Cloud Private

Published 2018-11-19 · Updated 2019-10-09 · CVE-2018-1843

Positive Technologies (AI Summary)

CVSS v3.1

4.1

Medium

Base vector

AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions IBM Cloud Private version 3.1.0

Description The issue is related to the Identity and Access Management (IAM) services not using a secure channel, such as SSL, to exchange information when accessed internally from within the cluster. This could allow an attacker with access to network traffic to intercept packets from the connection and uncover sensitive data. The vulnerability is caused by a lack of encryption measures for protected data, which could enable an attacker to disclose sensitive information.

Recommendations For IBM Cloud Private version 3.1.0, consider implementing SSL encryption for internal connections to prevent data interception. As a temporary workaround, restrict access to the IAM services to minimize the risk of exploitation.

Fix

Missing Encryption of Sensitive Data

Information Disclosure

Weakness Enumeration

CWE-311

CWE-200

Related Identifiers

BDU:2018-01540

CVE-2018-1843

Affected Products

Ibm Cloud Private

References · 7

• https://bdu.fstec.ru/vul/2018-01540 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2018-1843 · Security Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/150903 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2018-1843 · Vendor Advisory
• http://ibm.com/support/docview.wss?uid=ibm10739845 · Vendor Advisory
• https://www-01.ibm.com/support/docview.wss?uid=ibm10739845 · Note
• https://cxsecurity.com/cveshow/CVE-2018-1843/; · Note