CVE-2019-4239 - OpenCVE

IBM MQ Advanced Cloud Pak (IBM Cloud Private 1.0.0 through 3.0.1) stores user credentials in plain in clear text which can be read by a local user. IBM X-Force ID: 159465.

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact None

Availability Impact None

User Interaction None

Attack Vector Local

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact None

Availability Impact None

User Interaction None

Access Vector Local

Access Complexity Low

Authentication None

Confidentiality Impact Partial

Integrity Impact None

Availability Impact None

AV:L/AC:L/Au:N/C:P/I:N/A:N

Vendors & Products
CPE Configurations

Vendors	Products
Redhat	Openshift
Ibm	Cloud Private

Configuration 1 [-]

cpe:2.3:a:ibm:cloud_private:*:*:*:*:*:*:*:*

Configuration 2 [-]

AND

cpe:2.3:a:ibm:cloud_private:*:*:*:*:*:*:*:*

cpe:2.3:a:redhat:openshift:-:*:*:*:*:*:*:*

References

Link	Resource
https://exchange.xforce.ibmcloud.com/vulnerabilities/159465	VDB Entry Vendor Advisory
https://www.ibm.com/support/docview.wss?uid=ibm10886591	Vendor Advisory

History

No history.

MITRE Information

Status: PUBLISHED

Assigner: ibm

Published: 2019-06-07T00:00:00

Updated: 2019-06-14T14:45:17

Reserved: 2019-01-03T00:00:00

Link: CVE-2019-4239

JSON object: View

NVD Information

Status : Analyzed

Published: 2019-06-14T15:29:00.277

Modified: 2023-02-03T14:16:39.480

Link: CVE-2019-4239

JSON object: View

Redhat Information

No data.

CWE

CWE-522

{"containers": {"cna": {"affected": [{"product": "MQ Advanced Cloud Pak (IBM Cloud Private)", "vendor": "IBM", "versions": [{"status": "affected", "version": "1.0.0"}, {"status": "affected", "version": "1.1.0"}, {"status": "affected", "version": "1.2.0"}, {"status": "affected", "version": "1.3.0"}, {"status": "affected", "version": "2.0.0"}, {"status": "affected", "version": "2.1.0"}, {"status": "affected", "version": "2.2.0"}, {"status": "affected", "version": "2.2.1"}, {"status": "affected", "version": "2.2.2"}, {"status": "affected", "version": "2.2.3"}, {"status": "affected", "version": "3.0.0"}, {"status": "affected", "version": "3.0.1"}]}, {"product": "MQ Advanced Cloud Pak (IBM Cloud Private on RedHat OpenShift)", "vendor": "IBM", "versions": [{"status": "affected", "version": "1.0.0"}, {"status": "affected", "version": "1.1.0"}, {"status": "affected", "version": "1.2.0"}, {"status": "affected", "version": "1.3.0"}, {"status": "affected", "version": "2.0.0"}, {"status": "affected", "version": "2.1.0"}, {"status": "affected", "version": "2.2.0"}, {"status": "affected", "version": "2.2.1"}, {"status": "affected", "version": "2.2.2"}, {"status": "affected", "version": "2.2.3"}, {"status": "affected", "version": "3.0.0"}, {"status": "affected", "version": "3.0.1"}]}], "datePublic": "2019-06-07T00:00:00", "descriptions": [{"lang": "en", "value": "IBM MQ Advanced Cloud Pak (IBM Cloud Private 1.0.0 through 3.0.1) stores user credentials in plain in clear text which can be read by a local user. IBM X-Force ID: 159465."}], "metrics": [{"cvssV3_0": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 6.2, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "exploitCodeMaturity": "UNPROVEN", "integrityImpact": "NONE", "privilegesRequired": "NONE", "remediationLevel": "OFFICIAL_FIX", "reportConfidence": "CONFIRMED", "scope": "UNCHANGED", "temporalScore": 5.4, "temporalSeverity": "MEDIUM", "userInteraction": "NONE", "vectorString": "CVSS:3.0/PR:N/A:N/S:U/AV:L/I:N/AC:L/UI:N/C:H/RL:O/RC:C/E:U", "version": "3.0"}}], "problemTypes": [{"descriptions": [{"description": "Obtain Information", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2019-06-14T14:45:17", "orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522", "shortName": "ibm"}, "references": [{"tags": ["x_refsource_CONFIRM"], "url": "https://www.ibm.com/support/docview.wss?uid=ibm10886591"}, {"name": "ibm-mq-cve20194239-info-disc (159465)", "tags": ["vdb-entry", "x_refsource_XF"], "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/159465"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "psirt@us.ibm.com", "DATE_PUBLIC": "2019-06-07T00:00:00", "ID": "CVE-2019-4239", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "MQ Advanced Cloud Pak (IBM Cloud Private)", "version": {"version_data": [{"version_value": "1.0.0"}, {"version_value": "1.1.0"}, {"version_value": "1.2.0"}, {"version_value": "1.3.0"}, {"version_value": "2.0.0"}, {"version_value": "2.1.0"}, {"version_value": "2.2.0"}, {"version_value": "2.2.1"}, {"version_value": "2.2.2"}, {"version_value": "2.2.3"}, {"version_value": "3.0.0"}, {"version_value": "3.0.1"}]}}, {"product_name": "MQ Advanced Cloud Pak (IBM Cloud Private on RedHat OpenShift)", "version": {"version_data": [{"version_value": "1.0.0"}, {"version_value": "1.1.0"}, {"version_value": "1.2.0"}, {"version_value": "1.3.0"}, {"version_value": "2.0.0"}, {"version_value": "2.1.0"}, {"version_value": "2.2.0"}, {"version_value": "2.2.1"}, {"version_value": "2.2.2"}, {"version_value": "2.2.3"}, {"version_value": "3.0.0"}, {"version_value": "3.0.1"}]}}]}, "vendor_name": "IBM"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "IBM MQ Advanced Cloud Pak (IBM Cloud Private 1.0.0 through 3.0.1) stores user credentials in plain in clear text which can be read by a local user. IBM X-Force ID: 159465."}]}, "impact": {"cvssv3": {"BM": {"A": "N", "AC": "L", "AV": "L", "C": "H", "I": "N", "PR": "N", "S": "U", "UI": "N"}, "TM": {"E": "U", "RC": "C", "RL": "O"}}}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "Obtain Information"}]}]}, "references": {"reference_data": [{"name": "https://www.ibm.com/support/docview.wss?uid=ibm10886591", "refsource": "CONFIRM", "title": "IBM Security Bulletin 886591 (Application Integration and Connectivity)", "url": "https://www.ibm.com/support/docview.wss?uid=ibm10886591"}, {"name": "ibm-mq-cve20194239-info-disc (159465)", "refsource": "XF", "title": "X-Force Vulnerability Report", "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/159465"}]}}}}, "cveMetadata": {"assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522", "assignerShortName": "ibm", "cveId": "CVE-2019-4239", "datePublished": "2019-06-07T00:00:00", "dateReserved": "2019-01-03T00:00:00", "dateUpdated": "2019-06-14T14:45:17", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.0"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:ibm:cloud_private:*:*:*:*:*:*:*:*", "matchCriteriaId": "9394AFCC-A7FA-414D-B6AD-B62ECD9863B3", "versionEndIncluding": "3.0.1", "versionStartIncluding": "1.0.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:ibm:cloud_private:*:*:*:*:*:*:*:*", "matchCriteriaId": "DCDA100F-86AF-4BBF-B7CA-5C68170BD58E", "versionEndIncluding": "2.3.1", "versionStartIncluding": "2.1.0", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:a:redhat:openshift:-:*:*:*:*:*:*:*", "matchCriteriaId": "F08E234C-BDCF-4B41-87B9-96BD5578CBBF", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}], "descriptions": [{"lang": "en", "value": "IBM MQ Advanced Cloud Pak (IBM Cloud Private 1.0.0 through 3.0.1) stores user credentials in plain in clear text which can be read by a local user. IBM X-Force ID: 159465."}, {"lang": "es", "value": "IBM MQ Advanced Cloud Pak (IBM Cloud Private versi\u00f3n 1.0.0 hasta 3.0.1) almacena las credenciales de usuario en texto plano y sin cifrar que puede ser le\u00edda por un usuario local. ID de IBM X-Force: 159465."}], "id": "CVE-2019-4239", "lastModified": "2023-02-03T14:16:39.480", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "LOW", "cvssData": {"accessComplexity": "LOW", "accessVector": "LOCAL", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 2.1, "confidentialityImpact": "PARTIAL", "integrityImpact": "NONE", "vectorString": "AV:L/AC:L/Au:N/C:P/I:N/A:N", "version": "2.0"}, "exploitabilityScore": 3.9, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV30": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 6.2, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.0"}, "exploitabilityScore": 2.5, "impactScore": 3.6, "source": "psirt@us.ibm.com", "type": "Secondary"}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2019-06-14T15:29:00.277", "references": [{"source": "psirt@us.ibm.com", "tags": ["VDB Entry", "Vendor Advisory"], "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/159465"}, {"source": "psirt@us.ibm.com", "tags": ["Vendor Advisory"], "url": "https://www.ibm.com/support/docview.wss?uid=ibm10886591"}], "sourceIdentifier": "psirt@us.ibm.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-522"}], "source": "nvd@nist.gov", "type": "Primary"}]}