IBM Security Bulletin: IBM® Intelligent Operations Center has a weak user-creation policy (CVE-2019-4066)

Jun 6, 2019 9:01 am EDT

Categorized: High Severity

Share this post:

An authenticated user can create users with malformed user IDs in IBM® Intelligent Operations Center so that these new users cannot be deleted later from the system. Because the malformed users cannot be deleted at the application level, this is a denial of service issue.

CVE(s): CVE-2019-4066

Affected product(s) and affected version(s):
This vulnerability affects the following products and versions:

• IBM® Intelligent Operations Center V5.1.0 – V5.2.0
• IBM® Intelligent Operations Center for Emergency Management V5.1.0 – V5.1.0.6
• IBM® Water Operations for Waternamics V5.1.0 – V5.2.1.1

Refer to the following reference URLs for remediation and additional vulnerability details:
Source Bulletin: https://www-01.ibm.com/support/docview.wss?uid=ibm10879381
X-Force Database: https://exchange.xforce.ibmcloud.com/vulnerabilities/157011

from IBM Product Security Incident Response Team https://ibm.co/2ES0dR6