Sensitive Token Exposure in IBM Cloud Private by IBM
CVE-2019-4284

4.4MEDIUM

Key Information:

Vendor
IBM
Status
Cloud Private
Vendor
CVE Published:
5 August 2019

Summary

A vulnerability in IBM Cloud Private allows local privileged users to access sensitive OpenID Connect (OIDC) tokens logged in the system log files. The exposure of these tokens poses a significant risk as they can be utilized to impersonate other users, granting unauthorized access to the system. It's crucial for organizations using affected versions to implement necessary security updates to mitigate potential risks associated with this issue.

Affected Version(s)

Cloud Private 2.1.0

Cloud Private 3.1.0

Cloud Private 3.1.1

References

https://www.ibm.com/support/docview.wss?uid=ibm10885454
x_refsource_CONFIRM
https://exchange.xforce.ibmcloud.com/vulnerabilities/160512
vdb-entryx_refsource_XF

CVSS V3.1

Score:
4.4
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.