SB2020110639 - Missing encryption of sensitive data in IBM Cloud Automation Manager
Published: November 6, 2020 Updated: June 13, 2023
Security Bulletin ID
SB2020110639
CSH Severity
Low
Patch available
YES
Number of vulnerabilities
1
Exploitation vector
Adjecent network
Highest impact
Information disclosure
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 1 vulnerability.
1) Missing Encryption of Sensitive Data (CVE-ID: CVE-2019-4616)
CWE-ID: CWE-311 - Missing Encryption of Sensitive Data
CVSSv4: CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear
The vulnerability allows an adjacent attacker to gain access to potentially sensitive information.
The vulnerability exists due to IBM Cloud Automation Manager does not set the secure attribute on authorization tokens or session cookies. An adjacent attacker can get the cookie values by sending a http:// link to a user or by planting this link in a site the user goes to.
Remediation
Install update from vendor's website.