CVE-2019-4399

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

IBM Cloud Orchestrator 2.4 through 2.4.0.5 and 2.5 through 2.5.0.9 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 162260.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-327

Affected software

VendorProductVersions
IBMCloud Orchestrator2.4; 2.4.0.1; 2.4.0.2; 2.5; 2.5.0.1; 2.4.0.3; 2.5.0.2; 2.4.0.4; 2.5.0.3; 2.5.0.4; 2.4.0.5; 2.5.0.5; 2.5.0.6; 2.5.0.7; 2.5.0.8; 2.5.0.9

References

Timeline

Published
Oct 25, 2019
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2019

CVE-2019-44004.3IBM Cloud Orchestrator 2.4 through 2.4.0.5 and 2.5 through 2.5.0.9 could allow a remote attacker to traverse directories on the system. An aCVE-2019-44027.5IBM API Connect 2018.1 through 2018.4.1.6 developer portal could allow an unauthorized user to cause a denial of service via an unprotected CVE-2019-44035.4IBM Connections 6.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI CVE-2019-44064.4IBM Spectrum Protect Backup-Archive Client 7.1 and 8.1 may be vulnerable to a denial of service attack due to a timing issue between client CVE-2019-44095.4HCL Traveler versions 9.x and earlier are susceptible to cross-site scripting attacks. On the Problem Report page of the Traveler servlet paCVE-2019-44105.4IBM Business Automation Workflow 18.0.0.0, 18.0.0.1, 18.0.0.2, and 19.0.0.1 is vulnerable to cross-site scripting. This vulnerability allowsCVE-2019-44114.3IBM Cognos Controller 10.3.0, 10.3.1, 10.4.0, and 10.4.1 could allow an authenticated user to obtain sensitive information due to easy to guCVE-2019-44125.3IBM Cognos Controller stores sensitive information in URL parameters. This may lead to information disclosure if unauthorized parties have aCVE-2019-44157.8IBM Cloud Private 3.1.1 and 3.1.2 could allow a local user to obtain elevated privileges due to improper security context constraints. IBM XCVE-2019-44198.2IBM Intelligent Operations Center V5.1.0 through V5.2.0 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML dCVE-2019-44206.2IBM Intelligent Operations Center V5.1.0 through V5.2.0 could disclose detailed error messages, revealing sensitive information that could aCVE-2019-44228.8IBM Security Guardium 9.0, 9.5, and 10.6 are vulnerable to a privilege escalation which could allow an authenticated user to change the acce