7.5 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
HIGH
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
6 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
MEDIUM
Authentication
SINGLE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:M/Au:S/C:P/I:P/A:P
A vulnerability was identified within the Apache Log4j library that is used by IBM Cloud Pak for Network Automation to provide logging functionality. This vulnerability has been addressed.
CVEID:CVE-2021-4104
**DESCRIPTION:**Apache Log4j could allow a remote attacker to execute arbitrary code on the system, caused by the deserialization of untrusted data when the attacker has write access to the Log4j configuration. If the deployed application is configured to use JMSAppender, an attacker could exploit this vulnerability to execute arbitrary code on the system.
CVSS Base score: 8.1
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/215048 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H)
Affected Product(s) | Version(s) |
---|---|
IBM Cloud Pak for Network Automation | TNC-O 1.1 |
IBM Cloud Pak for Network Automation | TNC-O 1.2 |
IBM Cloud Pak for Network Automation | TNC-O 1.3.0 |
CP4NA | 2.x |
Product | V.R.M | Remediation |
---|---|---|
IBM Cloud Pak for Network Automation | TNC-O 1.1 | Upgrade to IBM Cloud Pak for Network Automation v 2.2.1 using the following instructions |
https://www.ibm.com/docs/en/cloud-paks/cp-network-auto/2.2.x
IBM Cloud Pak for Network Automation| TNC-O 1.2|
Upgrade to IBM Cloud Pak for Network Automation v 2.2.1 using the following instructions
https://www.ibm.com/docs/en/cloud-paks/cp-network-auto/2.2.x
IBM Cloud Pak for Network Automation| TNC-O 1.3.0|
Upgrade to IBM Cloud Pak for Network Automation v 2.2.1 using the following instructions
https://www.ibm.com/docs/en/cloud-paks/cp-network-auto/2.2.x
CP4NA| 2.x|
Upgrade to IBM Cloud Pak for Network Automation v 2.2.1 using the following instructions
https://www.ibm.com/docs/en/cloud-paks/cp-network-auto/2.2.x
None
CPE | Name | Operator | Version |
---|---|---|---|
ibm telco network cloud manager | eq | 1.3 |
7.5 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
HIGH
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
6 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
MEDIUM
Authentication
SINGLE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:M/Au:S/C:P/I:P/A:P