IBMA908B144946A19A4735DE72DDDE9C183B335A2C15BA3389E117C95B54B39A433Security Bulletin: IBM Sterling Partner Engagement Manager is vulnerable to information disclosure vulnerability due to org.glassfish.jersey.core_jersey-common (CVE-2021-28168)
5.5 Medium
CVSS3
Attack Vector
LOCAL
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
NONE
Availability Impact
NONE
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
2.1 Low
CVSS2
Access Vector
LOCAL
Access Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
NONE
Availability Impact
NONE
AV:L/AC:L/Au:N/C:P/I:N/A:N
0.0004 Low
EPSS
Percentile
9.3%
Summary
IBM Sterling Partner Engagement Manager has addressed vulnerability mentioned in CVE by updating to latest versions of libraries.
Vulnerability Details
CVEID:CVE-2021-28168
**DESCRIPTION:**Eclipse Jersey could allow a local attacker to obtain sensitive information, caused by use of the File.createTempFile. An attacker could exploit this vulnerability to obtain sensitive information and use this information to launch further attacks against the affected system.
CVSS Base score: 6.2
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/200601 for the current score.
CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)
Affected Products and Versions
| Affected Product(s) | Version(s) |
|---|---|
| IBM Sterling Partner Engagement Manager Essentials and Standard Editions | 6.2.1 |
| IBM Sterling Partner Engagement Manager Essentials and Standard Editions | 6.2.2 |
| IBM Sterling Partner Engagement Manager Essentials and Standard Editions | 6.1.2 |
| IBM Sterling Partner Engagement Manager Essentials and Standard Editions | 6.2.0 |
Remediation/Fixes
Workarounds and Mitigations
None
Related
5.5 Medium
CVSS3
Attack Vector
LOCAL
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
NONE
Availability Impact
NONE
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
2.1 Low
CVSS2
Access Vector
LOCAL
Access Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
NONE
Availability Impact
NONE
AV:L/AC:L/Au:N/C:P/I:N/A:N
0.0004 Low
EPSS
Percentile
9.3%