Skip to main content

Cloud Pak For Automation CVE-2021-20358

MEDIUM
Cleartext Storage of Sensitive Information (CWE-312)
2021-02-08 psirt@us.ibm.com
IBM Information Disclosure Cloud Pak For Automation
6.5
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
6.5 MEDIUM
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
None
Availability
None

Lifecycle Timeline

1
CVE Published
Feb 08, 2021 - 15:15 nvd
MEDIUM 6.5

DescriptionNVD

IBM Cloud Pak for Automation 20.0.3, 20.0.2-IF002 stores potentially sensitive information in clear text in API connection log files. This information could be obtained by a user with permissions to read log files. IBM X-Force ID: 194965.

AnalysisAI

IBM Cloud Pak for Automation 20.0.3, 20.0.2-IF002 stores potentially sensitive information in clear text in API connection log files. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

Technical ContextAI

This vulnerability is classified under CWE-312. IBM Cloud Pak for Automation 20.0.3, 20.0.2-IF002 stores potentially sensitive information in clear text in API connection log files. This information could be obtained by a user with permissions to read log files. IBM X-Force ID: 194965. Affected products include: Ibm Cloud Pak For Automation.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.

More in Cloud Pak For Automation

View all
CVE-2021-20482 HIGH
7.1 Mar 30

IBM Cloud Pak for Automation 20.0.2 and 20.0.3 IF002 are vulnerable to an XML External Entity Injection (XXE) attack whe
CVE-2021-20359 MEDIUM
6.5 Feb 08

IBM Cloud Pak for Automation 20.0.3, 20.0.2-IF002 - Business Automation Application Designer Component stores potentiall
CVE-2020-4325 MEDIUM
6.5 Apr 02

The IBM Process Federation Server 18.0.0.1, 18.0.0.2, 19.0.0.1, 19.0.0.2, and 19.0.0.3 Global Teams REST API does not pr
CVE-2021-38966 MEDIUM
5.4 Dec 21

IBM Cloud Pak for Automation 21.0.2 is vulnerable to cross-site scripting. Rated medium severity (CVSS 5.4), this vulner
CVE-2021-29775 MEDIUM
5.4 Jun 28

IBM Business Automation Workflow 19.0.03 and 20.0 and IBM Cloud Pak for Automation 20.0.3-IF002 and 21.0.1 are vulnerabl

Same weakness CWE-312 – Cleartext Storage of Sensitive Information

View all
CVE-2025-22896 CRITICAL POC
9.2
CVE-2023-31069 CRITICAL POC
9.8
CVE-2022-26148 CRITICAL POC
9.8
CVE-2021-29954 CRITICAL POC
9.8
CVE-2020-5723 CRITICAL POC
9.8
CVE-2019-19228 CRITICAL POC
9.8
CVE-2019-13096 CRITICAL POC
9.8
CVE-2019-11384 CRITICAL POC
9.8

Same technique Information Disclosure

View all
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8
CVE-2023-7028 CRITICAL POC
10.0
CVE-2017-0213 HIGH POC
7.3

Share

CVE-2021-20358 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy