Directory Traversal Vulnerability in IBM Cloud Orchestrator
CVE-2019-4400

4.3MEDIUM

Key Information:

Vendor: IBM
Status: Cloud Orchestrator
Vendor: CVE Published:; 25 October 2019

Summary

IBM Cloud Orchestrator versions 2.4 through 2.4.0.5 and 2.5 through 2.5.0.9 contain a vulnerability that allows remote attackers to exploit directory traversal. By sending specially-crafted URL requests incorporating 'dot dot' sequences (e.g., /../), an attacker can potentially view sensitive files on the system, leading to unauthorized data exposure.

Affected Version(s)

Cloud Orchestrator 2.4

Cloud Orchestrator 2.4.0.1

Cloud Orchestrator 2.4.0.2

References

https://www.ibm.com/support/pages/node/1077129

x_refsource_CONFIRM

https://exchange.xforce.ibmcloud.com/vulnerabilities/162261

vdb-entryx_refsource_XF

CVSS V3.1

Score:

4.3

Severity:

MEDIUM

Confidentiality:

Low

Integrity:

None

Availability:

Low

Attack Vector:

Network

Attack Complexity:

Low

Privileges Required:

Low

User Interaction:

None

Scope:

Unchanged

Timeline

Vulnerability published
Oct 25, 2019
Vulnerability Reserved
Jan 3, 2019