Cleartext storage of sensitive information in IBM Security Risk Manager - CVE-2021-38911
Published: September 12, 2022
Vulnerability identifier: #VU67187
CSH Severity: Low
CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2021-38911
CWE-ID: CWE-312
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows an authenticated privileged user to gain access to sensitive information.
The vulnerability exists due to IBM Security Risk Manager stores user credentials in plain clear text. An authenticated privileged user can trigger the vulnerability and gain access to sensitive information.
Affected software
IBM Security Risk Manager
How to mitigate CVE-2021-38911
Install updates from vendor's website.
IBM Security Risk Manager - update to 1.8.0.0