CVE-2019-4398
First published: Wed Oct 23 2019(Updated: )
IBM Cloud Orchestrator could allow a local user to obtain sensitive information from SessionManagement cookies.
Credit: psirt@us.ibm.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| IBM Cloud Orchestrator Enterprise | >=2.4<=2.4.0.5 | |
| IBM Cloud Orchestrator Enterprise | >=2.5<=2.5.0.9 | |
| IBM Cloud Orchestrator Enterprise | >=2.4<=2.4.0.5 | |
| IBM Cloud Orchestrator Enterprise | >=2.5<=2.5.0.9 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2019-4398?
CVE-2019-4398 has a medium severity rating due to its potential to expose sensitive information.
How do I fix CVE-2019-4398?
To fix CVE-2019-4398, update IBM Cloud Orchestrator or IBM Cloud Orchestrator Enterprise to the latest versions available beyond the affected versions.
Who is affected by CVE-2019-4398?
CVE-2019-4398 affects IBM Cloud Orchestrator versions 2.4 up to 2.4.0.5 and 2.5 up to 2.5.0.9, as well as the corresponding versions of IBM Cloud Orchestrator Enterprise.
What kind of information is compromised by CVE-2019-4398?
CVE-2019-4398 could allow local users to access sensitive information contained in SessionManagement cookies.
Is there a workaround for CVE-2019-4398?
Currently, there are no documented workarounds for CVE-2019-4398; the recommended solution is to apply the appropriate updates.
- agent/references
- agent/type
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- collector/ibm-support
- source/IBM
- agent/weakness
- agent/severity
- agent/remedy
- agent/author
- agent/last-modified-date
- agent/first-publish-date
- agent/description
- agent/event
- agent/trending
- agent/source
- agent/tags
- collector/nvd-index
- agent/software-canonical-lookup-request
- vendor/ibm
- canonical/ibm cloud orchestrator enterprise
- version/ibm cloud orchestrator enterprise/2.4
- version/ibm cloud orchestrator enterprise/2.4.0.5
- version/ibm cloud orchestrator enterprise/2.5
- version/ibm cloud orchestrator enterprise/2.5.0.9