CVE-2021-38938

MediumCVSS 5.5/10Last modified Jun 17, 2026

Description

IBM Host Access Transformation Services (HATS) 9.6 through 9.6.1.4 and 9.7 through 9.7.0.3 stores user credentials in plain clear text which can be read by a local user. IBM X-Force ID: 210989.

Metrics

CVSS 3.1 5.5/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-522

Affected software

Vendor	Product	Versions
IBM	Host Access Transformation Services	>= 9.6, <= 9.6.1.4; >= 9.7, <= 9.7.0.3

References

https://exchange.xforce.ibmcloud.com/vulnerabilities/210989VDB Entry, Vendor Advisory
https://www.ibm.com/support/pages/node/6832964Patch, Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/210989VDB Entry, Vendor Advisory
https://www.ibm.com/support/pages/node/6832964Patch, Vendor Advisory

Timeline

Published: Mar 15, 2024
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-389395.3IBM QRadar SIEM 7.3, 7.4, and 7.5 stores potentially sensitive information in log files that could be read by an user with access to creatin CVE-2021-389418.1IBM CloudPak for Multicloud Monitoring 2.0 and 2.3 has a few containers running in privileged mode which is vulnerable to host information l CVE-2021-389446.1IBM DataPower Gateway 10.0.2.0 through 1.0.3.0, 10.0.1.0 through 10.0.1.5, and 2018.4.1.0 through 2018.4.1.18 is vulnerable to HTTP header i CVE-2021-389459.8IBM Cognos Analytics 11.2.1, 11.2.0, and 11.1.7 could allow a remote attacker to upload arbitrary files, caused by improper content validati CVE-2021-389465.4IBM Cognos Analytics 11.1.7, 11.2.0, and 11.1.7 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary Ja CVE-2021-389477.5IBM Spectrum Copy Data Management 2.2.13 and earlier uses weaker than expected cryptographic algorithms that could allow an attacker to decr CVE-2021-389489.1IBM InfoSphere Information Server 11.7 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote att CVE-2021-389495.5IBM MQ 7.5, 8.0, 9.0 LTS, 9.1 CD, and 9.1 LTS stores user credentials in plain clear text which can be read by a local user. IBM X-Force ID:CVE-2021-389507.8IBM MQ on HPE NonStop 8.0.4 and 8.1.0 is vulnerable to a privilege escalation attack when SharedBindingsUserId is set to effective. IBM X-Fo CVE-2021-389517.5IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 is vulnerable to a denial of service, caused by sending a specially-crafted request.CVE-2021-389525.4IBM InfoSphere Information Server 11.7 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript CVE-2021-389544.3IBM Sterling B2B Integrator Standard Edition 6.0.0.0 through 6.0.3.5 and 6.1.0.0 through 6.1.1.0 could disclose sensitive version informatio