Information Disclosure in IBM Cloud Orchestrator
CVE-2019-4398
4MEDIUM
Summary
IBM Cloud Orchestrator versions 2.5 through 2.5.0.9 and 2.4 through 2.4.0.5 are susceptible to a vulnerability that could allow local users to access sensitive information stored in SessionManagement cookies. This exposure may lead to unauthorized access to confidential data, highlighting the importance of applying security patches and implementing proper access controls to safeguard critical systems.
Affected Version(s)
Cloud Orchestrator 2.4
Cloud Orchestrator 2.4.0.1
Cloud Orchestrator 2.4.0.2
References
CVSS V3.1
Score:
4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged
Timeline
Vulnerability published
Vulnerability Reserved