Security Bulletin: i2 Analyze has an information disclosure vulnerability (CVE-2019-17638)

Summary i2 Analyze uses a version of Jetty wth known vulnerabilities. Vulnerability Details CVEID: CVE-2019-17638 DESCRIPTION: Eclipse Jetty, as bundled in Jenkins, could allow a remote attacker to obtain sensitive information, caused by an issue with corrupt HTTP response buffer being sent to...

CVE-2021-29766

IBM i2 Analyst's Notebook Premium IBM i2 Analyze 4.3.0, 4.3.1, and 4.3.2 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system. IBM X-Force ID: 202680...

CVE-2021-29766

IBM i2 Analyst's Notebook Premium IBM i2 Analyze 4.3.0, 4.3.1, and 4.3.2 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system. IBM X-Force ID: 202680...

CVE-2021-29769

IBM i2 Analyst's Notebook Premium IBM i2 Analyze 4.3.0, 4.3.1, and 4.3.2 does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie values by sending a http:// link to a user or by planting this link in a site the user goes to. The cookie...

Information disclosure

IBM i2 Analyst's Notebook Premium 9.2.0, 9.2.1, and 9.2.2 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system. IBM X-Force ID: 202681...

Authorization

IBM i2 Analyst's Notebook Premium IBM i2 Analyze 4.3.0, 4.3.1, and 4.3.2 does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie values by sending a http:// link to a user or by planting this link in a site the user goes to. The cookie...

CVE-2021-29770

CVE-2021-29770 affects IBM i2 Analyze and Analyst’s Notebook Premium. The issue arises from hazardous input validation in certain data fields that can allow an authenticated user to perform unauthorized actions. Affected products/versions include IBM i2 Analyze 4.3.0, 4.3.1, and 4.3.2. The IBM ad...

CVE-2021-29769

The CVE-2021-29769 issue affects IBM i2 Analyze Premium (IBM i2 Analyze 4.3.0, 4.3.1, 4.3.2). Root cause: authorization tokens and session cookies lack the Secure attribute, enabling cookie values to be leaked if a user visits an HTTP link or a compromised site. Impact: information disclosure via...

CVE-2021-29766

CVE-2021-29766 affects IBM i2 Analyze (Analyst’s Notebook Premium) versions 4.3.0, 4.3.1, and 4.3.2. The vulnerability is an information-disclosure flaw where detailed browser error messages may reveal sensitive data to remote attackers, potentially aiding further attacks. Documented CVSS: 3.x ve...

CVE-2021-20430: Generation of Error Message Containing Sensitive Information

IBM i2 Analyst's Notebook Premium IBM i2 Analyze 4.3.0, 4.3.1, and 4.3.2 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system. IBM X-Force ID: 196341...

PT-2021-18464

Name of the Vulnerable Software and Affected Versions IBM i2 Analyst's Notebook Premium versions 4.3.0 through 4.3.2 Description The issue allows a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in...

PT-2021-13960

Name of the Vulnerable Software and Affected Versions: IBM i2 Analyst's Notebook Premium versions 4.3.0 through 4.3.2 Description: The issue allows a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used ...

CVE-2021-20431: Insufficient Session Expiration

IBM i2 Analyst's Notebook Premium 9.2.0, 9.2.1, and 9.2.2 does not invalidate session after logout which could allow an an attacker to obtain sensitive information from the system. IBM X-Force ID: 196342...

PT-2021-18467

Name of the Vulnerable Software and Affected Versions IBM i2 Analyst's Notebook Premium versions 4.3.0 through 4.3.2 Description The issue allows an authenticated user to perform unauthorized actions due to hazardous input validation. Recommendations For versions 4.3.0 through 4.3.2, at the momen...

PT-2021-18465

Name of the Vulnerable Software and Affected Versions IBM i2 Analyst's Notebook Premium versions 9.2.0 through 9.2.2 Description The issue allows a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in...

CVE-2021-29770: Improper Input Validation

IBM i2 Analyst's Notebook Premium IBM i2 Analyze 4.3.0, 4.3.1, and 4.3.2 could allow an authenticated user to perform unauthorized actions due to hazardous input validation. IBM X-Force ID: 202771...

CVE-2021-29767: Generation of Error Message Containing Sensitive Information

IBM i2 Analyst's Notebook Premium 9.2.0, 9.2.1, and 9.2.2 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system. IBM X-Force ID: 202681...

PT-2021-18466

Name of the Vulnerable Software and Affected Versions IBM i2 Analyst's Notebook Premium versions 4.3.0 through 4.3.2 Description The issue concerns the failure to set the secure attribute on authorization tokens or session cookies. Attackers can exploit this by sending a http:// link to a user or...

CVE-2021-29769: Cleartext Transmission of Sensitive Information

IBM i2 Analyst's Notebook Premium IBM i2 Analyze 4.3.0, 4.3.1, and 4.3.2 does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie values by sending a http:// link to a user or by planting this link in a site the user goes to. The cookie...

PT-2021-13961

Name of the Vulnerable Software and Affected Versions: IBM i2 Analyst's Notebook Premium versions 9.2.0 through 9.2.2 Description: The issue allows an attacker to obtain sensitive information from the system because the session is not invalidated after logout. Recommendations: For versions 9.2.0...