PT-2021-12232 · Ibm · Ibm Cloud Pak System

Published 2021-01-04 · Updated 2021-07-21 · CVE-2020-4918

Positive Technologies (AI Summary)

CVSS v3.1

4.4

Medium

Base vector

AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions IBM Cloud Pak System version 2.3

Description The issue allows a local privileged user to disclose sensitive information due to an insecure direct object reference in the sell service console for the Platform System Manager.

Recommendations For IBM Cloud Pak System version 2.3, consider restricting access to the sell service console to minimize the risk of exploitation until a patch is available. As a temporary workaround, limit the privileges of local users to reduce the potential impact of the issue.

Fix

IDOR

Weakness Enumeration

CWE-639

Related Identifiers

CVE-2020-4918

Affected Products

Ibm Cloud Pak System

References · 6

• https://osv.dev/vulnerability/CVE-2020-4918 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-4918 · Security Note
• https://ibm.com/support/pages/node/6393554 · Vendor Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/191392 · Vendor Advisory
• https://t.me/cibsecurity/21526 · Telegram Post
• https://t.me/cvenotify/8145 · Telegram Post