7.4 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
HIGH
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
NONE
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
5.8 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
NONE
AV:N/AC:M/Au:N/C:P/I:P/A:N
0.001 Low
EPSS
Percentile
37.9%
A security vulnerability in NGINX ffects IBM Cloud Automation Manager.
CVEID:CVE-2021-3618
**DESCRIPTION:**Sendmail, vsftpd and NGINX could provide weaker than expected security, caused by an ALPACA (application layer protocol content confusion) attack, which exploits TLS servers implementing different protocols but using compatible certificates. By using man-in the-middle attack techniques, a remote attacker with access to victim’s traffic at the TCP/IP layer could redirect traffic from one subdomain to another, resulting in a valid TLS session. The session breaks the authentication of TLS and the packages become vulnerable to cross-protocol attacks.
CVSS Base score: 7.4
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/207761 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N)
Affected Product(s) | Version(s) |
---|---|
IBM Cloud Automation Manager | 4.2.0.1 |
Download IBM Cloud Automation Manager 4.2.0.1 iFix 4 from http://www.ibm.com/support/fixcentral/swg/selectFixes?product=ibm/WebSphere/IBM+Cloud+Private&release=All&platform=All&function=fixId&fixids=icp-cam-3.2.1-build600699&includeSupersedes=0
Follow the instructions in Readme link in http://www.ibm.com/support/fixcentral/swg/selectFixes?product=ibm/WebSphere/IBM+Cloud+Private&release=All&platform=All&function=fixId&fixids=icp-cam-3.2.1-build600699&includeSupersedes=0 to install the iFix 4 to your IBM Cloud Automation Manager 4.2.0.1.
None
CPE | Name | Operator | Version |
---|---|---|---|
ibm cloud automation manager | eq | 4.2.0.1 |
7.4 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
HIGH
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
NONE
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
5.8 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
NONE
AV:N/AC:M/Au:N/C:P/I:P/A:N
0.001 Low
EPSS
Percentile
37.9%