PT-2021-2374 · Ibm · Ibm Application Performance Management

Published 2021-02-26 · Updated 2021-03-08 · CVE-2020-4726

Positive Technologies (AI Summary)

CVSS v3.1

3.3

Low

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions IBM Application Performance Management (APM) version 8.1.4

Description The issue is related to a lack of protection for service data, which can allow an attacker to disclose protected information. Specifically, the IBM Application Performance Monitoring UI allows web pages to be stored locally, which can then be read by another user on the system.

Recommendations For version 8.1.4, consider restricting access to sensitive web pages stored locally to minimize the risk of unauthorized disclosure. As a temporary workaround, restrict access to the locally stored web pages until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Information Disclosure

Insecure Storage of Sensitive Information

Weakness Enumeration

CWE-200

CWE-922

Related Identifiers

BDU:2021-01614

CVE-2020-4726

Affected Products

Ibm Application Performance Management

References · 8

• https://bdu.fstec.ru/vul/2021-01614 · Security Note
• https://ibm.com/support/pages/node/6417137 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-4726 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-4726 · Security Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/187975 · Vendor Advisory
• https://t.me/cvenotify/10737 · Telegram Post
• https://cxsecurity.com/cveshow/CVE-2020-4726 · Note
• https://t.me/cibsecurity/24349 · Telegram Post