CVE-2019-4072 Security feature bypass in Spectrum Control Standard Edition
Attackers can bypass session termination by using the browser back button to access sensitive application data after logout.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2019-4072?
CVE-2019-4072 is a medium-severity vulnerability in IBM Spectrum Control Standard Edition, published on 9 May 2019. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
IBM Tivoli Storage Productivity Center (IBM Spectrum Control Standard Edition 5.2.1 through 5.2.17) allows users to remain idle within the application even when a user has logged out. Utilizing the application back button users can remain logged in as the current user for a short period of time, therefore users are presented with information for Spectrum Control Application. IBM X-Force ID: 157064.
Weakness: CWE-613
Which versions are affected by CVE-2019-4072?
It affects 2 products.
Products include Ibm Spectrum Control, Ibm Tivoli Storage Productivity Center.
How do I fix CVE-2019-4072?
No fix has been published for CVE-2019-4072 yet. Limit exposure of the affected software until one is available.
Is CVE-2019-4072 being exploited?
There is no known exploitation of CVE-2019-4072 in the wild and no public exploit code.
Other vulnerabilities in IBM Spectrum Control Standard Edition
- CVE-2016-8941 Cross-site request forgery in Spectrum Control Standard Select Edition
- CVE-2019-4071 Command injection in Spectrum Control Standard Edition
- CVE-2016-5946 Path traversal in n/a
- CVE-2019-4137 Cross-site scripting in Spectrum Control Standard Edition
- CVE-2019-4138 Information disclosure in Spectrum Control Standard Edition
Sources
Also known as GHSA-ffv4-58cg-f6v5.