Security Bulletin: Vulnerability in embedded IBM Websphere Application Server Liberty affects IBM Watson Compare and Comply for IBM Cloud Pak for Data

Summary

A vulnerability in the IBM WebSphere Application Server Liberty embedded in IBM Watson Compare and Comply for IBM Cloud Pak for Data could allow a remote attacker to obtain sensitive information caused by the improper setting of a cookie.

Vulnerability Details

CVEID:CVE-2019-4305
**DESCRIPTION:**IBM WebSphere Application Server Liberty could allow a remote attacker to obtain sensitive information caused by the improper setting of a cookie. IBM X-Force ID: 160951.
CVSS Base score: 5.3
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/160951 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)

Affected Products and Versions

Remediation/Fixes

Upgrade to IBM Watson Compare and Comply for IBM Cloud Pak for Data 1.1.7. To download the software, go to Passport Advantage, then search for “watson compare and comply for ICP for Data”, then select IBM Watson Compare and Comply for ICP for Data V1.1.7 Linux English , part number CC4U4EN.

Workarounds and Mitigations

None