If your IBM® Intelligent Operations Center system is configured to use a Lightweight Directory Access Protocol (LDAP) user registry, user passwords might be obtained by a brute force attack that uses HTTP basic authentication requests to IBM Intelligent Operations Center.
CVEID: CVE-2019-4067 DESCRIPTION: IBM Intelligent Operations Center does not require that users should have strong passwords by default, which makes it easier for attackers to compromise user accounts.
CVSS Base Score: 5.9
CVSS Temporal Score: See <https://exchange.xforce.ibmcloud.com/vulnerabilities/157012> for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N)
This vulnerability affects the following products and versions:
Ensure that your LDAP server is configured with a suitable Password Policy. For more information, see the troubleshooting document: User passwords might be obtained by a brute force attack on IBM® Intelligent Operations Center if your LDAP server does not have a secure Password Policy.