CVE-2019-4239

Summary: CVE-2019-4239 affects IBM MQ Advanced Cloud Pak (IBM Cloud Private 1.0.0–3.0.1). Affected systems store user credentials in plain text read-able by a local user. Impact (as stated): Local attacker could access plaintext credentials stored by the Cloud Pak deployment. Public metadata and ...

CVE-2019-4142

IBM Cloud Private is affected by CVE-2019-4142, a cross-site request forgery vulnerability affecting IBM Cloud Private versions 2.1.0, 3.1.0, 3.1.1, and 3.1.2. The issue allows an attacker to perform malicious, unauthorized actions transmitted from a trusted user. Remediation per IBM security bul...

CVE-2019-4116

CVE-2019-4116 affects IBM Cloud Private versions 2.1.x, 3.1.0, and 3.1.1, where installer logs could disclose highly sensitive information that may enable further system attacks. Root cause: information leakage in installer logging. Impact: potential disclosure of confidential data within logs. R...

CVE-2019-4284

CVE-2019-4284 affects IBM Cloud Private. The vulnerability allows a local privileged user to obtain a sensitive OIDC token that is printed to log files, enabling authentication as another user. Affected versions: IBM Cloud Private 2.1.x, 3.1.0, 3.1.1, 3.1.2. Root cause: leakage of OIDC tokens via...

CVE-2018-1937

IBM Cloud Private 3.1.1 is affected by CVE-2018-1937. A local administrator could intercept highly sensitive unencrypted data due to insecure intra-service communications (IAM and OpenShift) over HTTP. The IBM Security Bulletin confirms the impact is data disclosure with local access and provides...

CVE-2018-1843

IBM Cloud Private 3.1.0 IAM services expose internal traffic over non-secure channels, allowing packet sniffing and data exposure. Affected product: IBM Cloud Private 3.1.0. Root cause: lack of secure channel (SSL) for in-cluster communications. Impact: potential confidentiality breach with local...

CVE-2018-1943

IBM Cloud Private is vulnerable to HTTP HOST header injection (CVE-2018-1943) in version 3.1.0 and 3.1.1 due to improper input validation. By enticing a user to a crafted page, an attacker could inject arbitrary HTTP headers, enabling cross-site scripting, cache poisoning, or session hijacking. R...

CVE-2019-4120

CVE-2019-4120 affects IBM Cloud Private versions 3.1.1 and 3.1.2, with a cross-site scripting vulnerability that allows arbitrary JavaScript execution in the Web UI, potentially leading to credentials disclosure within a trusted session. Root cause is input handling in the Web UI that enables inj...

CVE-2018-1938

The CVE-2018-1938 entry affects IBM Cloud Private 3.1.1, where a local administrator can intercept highly sensitive unencrypted data due to insecure in-cluster communications. Affected component/condition involves unencrypted data traffic between nodes and services (no remote-exploit detail provi...

CVE-2019-4143

The CVE-2019-4143 issue affects IBM Cloud Private before patches: IBM Cloud Private Key Management Service (KMS) in versions 3.1.1 and 3.1.2 can allow a local attacker to obtain sensitive information from the KMS plugin container log. Root cause involves information disclosure via container logs ...

CVE-2019-4415

CVE-2019-4415 affects IBM Cloud Private 3.1.1 and 3.1.2 where a local user can escalate privileges due to improper SecurityContextConstraints handling. The IBM security bulletin confirms icp-scc SCC is erroneously assigned to all pods, enabling privilege escalation. A remediation is provided for ...

CVE-2019-4439

The CVE-2019-4439 issue affects IBM Cloud Private 3.1.0–3.1.2, where sessions are not invalidated after logout, enabling a local user to impersonate another user. Root cause: logout does not terminate the session. Impact is Local, with partial confidentiality, integrity, and availability concerns...

CVE-2018-1939

Affected product: IBM Cloud Private 3.1.1. ** Vulnerability:** open redirect that enables remote attackers to conduct phishing by spoofing the displayed URL and redirecting users to a malicious site, potentially exposing sensitive information or enabling further attacks. Root cause/impact: open r...

CVE-2019-4117

IBM Cloud Private is affected by CVE-2019-4117: cross-site request forgery in Identity and Access Management modules for versions 3.1.1 and 3.1.2. The vulnerability enables an attacker to cause unauthorized actions transmitted from a trusted user. IBM’s security bulletin recommends applying patch...

CVE-2019-4119

IBM Cloud Private Kubernetes API server versions 2.1.x and 3.1.x (3.1.0, 3.1.1, 3.1.2) can be used as an HTTP proxy to reach internal and external target IPs. The root cause is an input/proxy handling issue that allows proxying beyond intended scope. Remediation per IBM’s bulletin: upgrade to IBM...

CVE-2018-1841

Summary : CVE-2018-1841 affects IBM Cloud Private 2.1.0, where the CA Private Key is world-readable on the boot/master node, enabling a local attacker to obtain the private key. Impact (as stated) : Information disclosure of the CA private key to a local user. The vulnerability is local in scope ...