CVE-2019-4385

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

IBM Spectrum Protect Plus 10.1.2 may display the vSnap CIFS password in the IBM Spectrum Protect Plus Joblog. This can result in an attacker gaining access to sensitive information as well as vSnap. IBM X-Force ID: 162173.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

Weakness enumeration

CWE-522

Affected software

Vendor	Product	Versions
IBM	Spectrum Protect Plus	10.1.2

References

http://www.ibm.com/support/docview.wss?uid=ibm10886099Patch, Vendor Advisory
http://www.securityfocus.com/bid/108899Broken Link, Third Party Advisory, VDB Entry
https://exchange.xforce.ibmcloud.com/vulnerabilities/162173VDB Entry, Vendor Advisory
http://www.ibm.com/support/docview.wss?uid=ibm10886099Patch, Vendor Advisory
http://www.securityfocus.com/bid/108899Broken Link, Third Party Advisory, VDB Entry
https://exchange.xforce.ibmcloud.com/vulnerabilities/162173VDB Entry, Vendor Advisory

Timeline

Published: Jun 19, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-43866.5IBM DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) 11.1 could allow an authenticated user to execute a function that would ca CVE-2019-43878.8IBM Sterling B2B Integrator Standard Edition 6.0.0.0 through 6.0.2.0 is vulnerable to SQL injection. A remote attacker could send specially-CVE-2019-43884.8HCL AppScan Source 9.0.3.13 and earlier is susceptible to cross-site scripting (XSS) attacks by allowing users to embed arbitrary JavaScript CVE-2019-43918.2HCL AppScan Standard is vulnerable to XML External Entity Injection (XXE) attack when processing XML data CVE-2019-43929.8HCL AppScan Standard Edition 9.0.3.13 and earlier uses hard-coded credentials which can be exploited by attackers to get unauthorized access CVE-2019-43939.8HCL AppScan Standard is vulnerable to excessive authorization attempts CVE-2019-43942.3IBM Cloud Orchestrator 2.4 through 2.4.0.5 and 2.5 through 2.5.0.9 contain APIs that could be used by a local user to send email. IBM X-Forc CVE-2019-43953.3IBM Cloud Orchestrator 2.4 through 2.4.0.5 and 2.5 through 2.5.0.9 could allow a local user to obtain sensitive information from temporary s CVE-2019-43965.4IBM Cloud Orchestrator 2.4 through 2.4.0.5 and 2.5 through 2.5.0.9 is vulnerable to HTTP response splitting attacks, caused by improper vali CVE-2019-43976.5IBM Cloud Orchestrator and IBM Cloud Orchestrator Enterprise 2.5 through 2.5.0.9 and 2.4 through 2.4.0.5 stores sensitive information in URL CVE-2019-43983.3IBM Cloud Orchestrator and IBM Cloud Orchestrator Enterprise 2.5 through 2.5.0.9 and 2.4 through 2.4.0.5 could allow a local user to obtain CVE-2019-43997.5IBM Cloud Orchestrator 2.4 through 2.4.0.5 and 2.5 through 2.5.0.9 uses weaker than expected cryptographic algorithms that could allow an at