PT-2022-5287 · Ibm · Ibm Host Access Transformation Services

Published 2022-10-28 · Updated 2024-03-19 · CVE-2021-38938

Positive Technologies (AI Summary)

CVSS v3.1

6.2

Medium

Base vector

AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions IBM Host Access Transformation Services (HATS) versions 9.6 through 9.6.1.4 IBM Host Access Transformation Services (HATS) versions 9.7 through 9.7.0.3

Description The issue is related to the storage of user credentials in plain clear text, which can be read by a local user. This can allow an attacker to gain unauthorized access to protected information.

Recommendations For versions 9.6 through 9.6.1.4, update to a version that stores user credentials securely. For versions 9.7 through 9.7.0.3, update to a version that stores user credentials securely. As a temporary workaround, consider restricting access to the system to minimize the risk of exploitation.

Fix

Insufficiently Protected Credentials

Cleartext Storage of Sensitive Information

Weakness Enumeration

CWE-522

CWE-312

Related Identifiers

BDU:2022-06572

CVE-2021-38938

Affected Products

Ibm Host Access Transformation Services

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2021-38938 · Security Note
• https://osv.dev/vulnerability/CVE-2021-38938 · Vendor Advisory
• https://bdu.fstec.ru/vul/2022-06572 · Security Note
• https://ibm.com/support/pages/node/6832964 · Vendor Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/210989 · Vendor Advisory
• https://ibm.com/blogs/psirt/security-bulletin-vulnerability-in-ibm-host-access-beans-affects-ibm-host-access-transformation-services · Note
• https://twitter.com/CVEnew/status/1768666549768896895 · Twitter Post