Skip to main content

Infosphere Information Server On Cloud CVE-2019-4220

MEDIUM
Use of Hard-coded Credentials (CWE-798)
2019-06-06 psirt@us.ibm.com
Authentication Bypass IBM Infosphere Information Server On Cloud Watson Knowledge Catalog
5.5
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
None
Availability
None

Lifecycle Timeline

1
CVE Published
Jun 06, 2019 - 01:29 nvd
MEDIUM 5.5

DescriptionNVD

IBM InfoSphere Information Server 11.7.1.0 stores a common hard coded encryption key that could be used to decrypt sensitive information. IBM X-Force ID: 159229.

AnalysisAI

IBM InfoSphere Information Server 11.7.1.0 stores a common hard coded encryption key that could be used to decrypt sensitive information. Rated medium severity (CVSS 5.5), this vulnerability is low attack complexity. No vendor patch available.

Technical ContextAI

This vulnerability is classified as Use of Hard-coded Credentials (CWE-798), which allows attackers to gain access using credentials embedded in source code. IBM InfoSphere Information Server 11.7.1.0 stores a common hard coded encryption key that could be used to decrypt sensitive information. IBM X-Force ID: 159229. Affected products include: Ibm Infosphere Information Server On Cloud, Ibm Watson Knowledge Catalog.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Remove hard-coded credentials, use environment variables or secrets management, rotate exposed credentials immediately.

More in Infosphere Information Server On Cloud

View all
CVE-2024-40689 CRITICAL
9.8 Jul 26

IBM InfoSphere Information Server 11.7 is vulnerable to SQL injection. Rated critical severity (CVSS 9.8), this vulnerab
CVE-2022-40752 CRITICAL
9.8 Nov 16

IBM InfoSphere DataStage 11.7 is vulnerable to a command injection vulnerability due to improper neutralization of speci
CVE-2020-4305 HIGH
8.8 Jul 09

IBM InfoSphere Information Server 11.3, 11.5, and 11.7 could allow a remote attacker to execute arbitrary code on the sy
CVE-2019-4185 HIGH
8.3 Jun 06

IBM InfoSphere Information Server 11.7.1 containers are vulnerable to privilege escalation due to an insecurely configur
CVE-2016-6059 HIGH
8.1 Feb 01

IBM InfoSphere Information Server is vulnerable to a denial of service, caused by an XML External Entity Injection (XXE)
CVE-2022-22454 HIGH
7.8 May 10

IBM InfoSphere Information Server 11.7 could allow a locally authenticated attacker to execute arbitrary commands on the
CVE-2025-1499 MEDIUM
6.5 Jun 01

IBM InfoSphere Information Server 11.7 stores credential information for database authentication in a cleartext paramete
CVE-2022-22442 MEDIUM
6.5 Nov 03

"IBM InfoSphere Information Server 11.7 could allow an authenticated user to access information restricted to users with
CVE-2020-4286 MEDIUM
6.5 May 19

IBM InfoSphere Information Server 11.3, 11.5, and 11.7 is vulnerable to cross-site request forgery which could allow an

CVE-2017-1321 MEDIUM
6.1 Jul 12

IBM InfoSphere Information Server 9.1, 11.3, and 11.5 is vulnerable to cross-site scripting. Rated medium severity (CVSS
CVE-2016-9000 MEDIUM
6.1 Feb 01

IBM InfoSphere DataStage is vulnerable to cross-frame scripting, caused by insufficient HTML iframe protection. Rated me
CVE-2016-5984 MEDIUM
6.1 Feb 01

IBM InfoSphere Information Server is vulnerable to cross-frame scripting, caused by insufficient HTML iframe protection.

Same weakness CWE-798 – Use of Hard-coded Credentials

View all
CVE-2016-1560 CRITICAL POC
9.8
CVE-2017-14143 CRITICAL POC
9.8
CVE-2026-22769 CRITICAL
10.0
CVE-2016-5678 CRITICAL POC
9.8
CVE-2017-6558 CRITICAL POC
9.8
CVE-2015-7246 CRITICAL POC
9.8
CVE-2015-4667 CRITICAL POC
9.8
CVE-2016-10177 CRITICAL POC
9.8

Same technique Authentication Bypass

View all
CVE-2023-22515 CRITICAL POC
9.8
CVE-2012-4681 CRITICAL POC
9.8
CVE-2013-2465 CRITICAL POC
9.8
CVE-2011-3544 CRITICAL POC
9.8
CVE-2012-1723 CRITICAL POC
9.8
CVE-2017-10271 HIGH POC
7.5
CVE-2015-1427 CRITICAL POC
9.8
CVE-2025-3248 CRITICAL POC
9.8

Share

CVE-2019-4220 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy