Security Bulletin: IBM Maximo Anywhere Discloses Sensitive Information in Local Storage

Summary

IBM Maximo Anywhere application stores the username in local storage as directory names to store user specific attachments.

Vulnerability Details

CVEID:CVE-2019-4351
**DESCRIPTION:**IBM Maximo Anywhere applications could disclose sensitive information to a user with physical access to the device.
CVSS Base score: 2.1
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/161493 for the current score.
CVSS Vector: (CVSS:3.0/AV:P/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N)

Affected Products and Versions

Remediation/Fixes

See Workarounds and Mitigations Section

Workarounds and Mitigations

Ensure the following mobile device security configurations are implemented to prevent exploitation of this vulnerability: password protection, device encryption, and having company devices running on an MDM so the end users do not access to the device file system.