PT-2019-17061 · Ibm · Ibm Cloud Orchestrator+1

Published 2019-10-24 · Updated 2021-07-21 · CVE-2019-4398

Positive Technologies (AI Summary)

CVSS v3.1

3.3

Low

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions IBM Cloud Orchestrator and IBM Cloud Orchestrator Enterprise versions 2.4 through 2.4.0.5 IBM Cloud Orchestrator and IBM Cloud Orchestrator Enterprise versions 2.5 through 2.5.0.9

Description The issue allows a local user to obtain sensitive information from SessionManagement cookies.

Recommendations For versions 2.4 through 2.4.0.5, update to a version outside of this range to mitigate the risk. For versions 2.5 through 2.5.0.9, update to a version outside of this range to mitigate the risk.

Fix

Files Accessible to External Parties

Weakness Enumeration

CWE-552

Related Identifiers

CVE-2019-4398

Affected Products

Ibm Cloud Orchestrator

Ibm Cloud Orchestrator Enterprise

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2019-4398 · Security Note
• https://ibm.com/support/pages/node/1077123 · Vendor Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/162259 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2019-4398 · Vendor Advisory