Security Bulletin
Summary
IBM Cloud Pak for Security versions 1.5.0.1 and earlier is vulnerable to the following CVEs: CVE-2021-20538, meaning that sensitive information can be obtained by the user without sufficient authorisation. CVE-2021-20577, allowing cross side scripting that can potentially lead to credentials disclosure. These are addressed in CP4S 1.6.0.0 and later versions
Vulnerability Details
CVEID: CVE-2021-20538
DESCRIPTION: IBM Cloud Pak for Security (CP4S) could allow a user to obtain sensitive information or perform actions they should not have access to due to incorrect authorization mechanisms.
CVSS Base score: 4.8
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/198919 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N)
CVEID: CVE-2021-20577
DESCRIPTION: IBM Cloud Pak for Security (CP4S) is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.
CVSS Base score: 4.3
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/199281 for the current score.
CVSS Vector: (CVSS:3.0/AV:A/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N)
Affected Products and Versions
| Affected Product(s) | Version(s) |
| Cloud Pak for Security (CP4S) | 1.5.0.0 |
| Cloud Pak for Security (CP4S) | 1.5.0.1 |
Remediation/Fixes
Upgrade to Cloud Pak for Security v 1.6.0.0 or higher following instructions https://www.ibm.com/docs/en/cloud-paks/cp-security/1.6.0?topic=security-upgrading-cloud-pak-150x
Workarounds and Mitigations
None
Get Notified about Future Security Bulletins
References
Acknowledgement
X-Force Ethical Hacking Team: John Zucatto, Rodney Ryan, Chris Shepherd, Nathan Roane, Elaheh Samani, Troy Fisher, Vincent Dragnea, Gabor Minyo, John Zuccato, Rodney Ryan, Chris Shepherd, Vince Dragnea, Troy Fisher, Nathan Roane, Elaheh Samani and Ga
Change History
28 Apr 2021: Initial Publication
*The CVSS Environment Score is customer environment specific and will ultimately impact the Overall CVSS Score. Customers can evaluate the impact of this vulnerability in their environments by accessing the links in the Reference section of this Security Bulletin.
Disclaimer
Review the IBM security bulletin disclaimer and definitions regarding your responsibilities for assessing potential impact of security vulnerabilities to your environment.
Document Location
Worldwide
Was this topic helpful?
Document Information
Modified date:
07 May 2021
UID
ibm16450849