CVE-2019-4706 Information disclosure in Security Identity Manager Virtual Appliance

What is CVE-2019-4706?

CVE-2019-4706 is a low-severity vulnerability in IBM Security Identity Manager Virtual Appliance, published on 1 Jul 2020. An attacker needs administrator access to exploit it, with no action from the victim.

Official description

IBM Security Identity Manager Virtual Appliance 7.0.2 writes information to log files which can be of a sensitive nature and give valuable guidance to an attacker or expose sensitive user information. IBM X-Force ID: 172016.

Weakness: CWE-532

Which versions are affected by CVE-2019-4706?

It affects 1 product.

Products include Ibm Security Identity Manager Virtual Appliance.

How do I fix CVE-2019-4706?

No fix has been published for CVE-2019-4706 yet. Limit exposure of the affected software until one is available.

Is CVE-2019-4706 being exploited?

There is no known exploitation of CVE-2019-4706 in the wild and no public exploit code.

Other vulnerabilities in IBM Security Identity Manager Virtual Appliance

• CVE-2016-0332 Security feature bypass in n/a Critical 9.8
• CVE-2016-0324 Command injection in n/a High 8.8
• CVE-2016-0327 Privilege escalation in n/a High 7.8
• CVE-2019-4676 Information disclosure in Security Identity Manager Virtual Appliance Medium 6.3
• CVE-2016-9704 Cross-site scripting in Identity Manager Medium 6.1

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-3x84-f4p2-cmpp.