CVE-2021-39090: IBM Cloud Pak for Security information disclosure
First published: Wed Jan 18 2023(Updated: )
IBM Cloud Pak for Security (CP4S) 1.10.0.0 through 1.10.6.0 could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable HTTP Strict Transport Security. An attacker could exploit this vulnerability to obtain sensitive information using man in the middle techniques. IBM X-Force ID: 216388.
Credit: psirt@us.ibm.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| IBM Cloud Pak for Security (CP4S) | <=1.10.0.0 - 1.10.6.0 | |
| All of | ||
| IBM Cloud Pak for Security | >=1.10.0.0<1.10.7.0 | |
| Linux Kernel |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2021-39090?
CVE-2021-39090 is classified as a medium severity vulnerability.
How do I fix CVE-2021-39090?
To fix CVE-2021-39090, upgrade IBM Cloud Pak for Security to version 1.10.7.0 or later.
What type of information could an attacker obtain from CVE-2021-39090?
An attacker could potentially obtain sensitive information due to the improper implementation of HTTP Strict Transport Security.
What versions of IBM Cloud Pak for Security are affected by CVE-2021-39090?
Versions 1.10.0.0 through 1.10.6.0 of IBM Cloud Pak for Security are affected by CVE-2021-39090.
Is there a public report available for CVE-2021-39090?
Yes, a public report detailing CVE-2021-39090 is available on IBM's support page.
- agent/title
- agent/references
- agent/type
- collector/ibm-support
- source/IBM
- agent/software-canonical-lookup
- agent/description
- agent/first-publish-date
- agent/severity
- agent/author
- agent/event
- collector/mitre-cve
- source/MITRE
- agent/trending
- agent/last-modified-date
- agent/weakness
- agent/softwarecombine
- agent/source
- agent/tags
- collector/nvd-api
- source/NVD
- agent/software-canonical-lookup-request
- vendor/ibm
- canonical/ibm cloud pak for security (cp4s)
- version/ibm cloud pak for security (cp4s)/1.10.0.0 - 1.10.6.0
- canonical/ibm cloud pak for security
- version/ibm cloud pak for security/1.10.0.0
- vendor/linux
- canonical/linux kernel