CVE-2019-4676 Information disclosure in Security Identity Manager Virtual Appliance

What is CVE-2019-4676?

CVE-2019-4676 is a medium-severity vulnerability in IBM Security Identity Manager Virtual Appliance, published on 1 Jul 2020. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

IBM Security Identity Manager Virtual Appliance 7.0.2 stores user credentials in plain in clear text which can be read by a local user. IBM X-Force ID: 171512.

Weakness: CWE-312

Which versions are affected by CVE-2019-4676?

It affects 1 product.

Products include Ibm Security Identity Manager Virtual Appliance.

How do I fix CVE-2019-4676?

No fix has been published for CVE-2019-4676 yet. Limit exposure of the affected software until one is available.

Is CVE-2019-4676 being exploited?

There is no known exploitation of CVE-2019-4676 in the wild and no public exploit code.

Other vulnerabilities in IBM Security Identity Manager Virtual Appliance

• CVE-2016-0332 Security feature bypass in n/a Critical 9.8
• CVE-2016-0324 Command injection in n/a High 8.8
• CVE-2016-0327 Privilege escalation in n/a High 7.8
• CVE-2016-9704 Cross-site scripting in Identity Manager Medium 6.1
• CVE-2018-1968 Information disclosure in Security Identity Manager Medium 5.3

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-7wgh-wfcj-6qrm.