IBM Security Bulletin: User passwords might be obtained by a brute force attack on IBM® Intelligent Operations Center (CVE-2019-4067)

Jun 6, 2019 9:01 am EDT

Categorized: Medium Severity

Share this post:

If your IBM® Intelligent Operations Center system is configured to use a Lightweight Directory Access Protocol (LDAP) user registry, user passwords might be obtained by a brute force attack that uses HTTP basic authentication requests to IBM Intelligent Operations Center.

CVE(s): CVE-2019-4067

Affected product(s) and affected version(s):
This vulnerability affects the following products and versions:

• IBM® Intelligent Operations Center V5.1.0 – V5.2.0
• IBM® Intelligent Operations Center for Emergency Management V5.1.0 – V5.1.0.6
• IBM® Water Operations for Waternamics V5.1.0 – V5.2.1.1

Refer to the following reference URLs for remediation and additional vulnerability details:
Source Bulletin: https://www-01.ibm.com/support/docview.wss?uid=ibm10880213
X-Force Database: https://exchange.xforce.ibmcloud.com/vulnerabilities/157012

from IBM Product Security Incident Response Team https://ibm.co/2ES0cg0