CVE-2021-39090

MediumCVSS 5.9/10Last modified Jun 17, 2026

Description

IBM Cloud Pak for Security (CP4S) 1.10.0.0 through 1.10.6.0 could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable HTTP Strict Transport Security. An attacker could exploit this vulnerability to obtain sensitive information using man in the middle techniques. IBM X-Force ID: 216388.

Metrics

CVSS 3.1 5.9/10CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-311 CWE-319

Affected software

Vendor	Product	Versions
IBM	Cloud Pak for Security	>= 1.10.0.0, <= 1.10.6.0

References

https://exchange.xforce.ibmcloud.com/vulnerabilities/216388Vendor Advisory
https://www.ibm.com/support/pages/node/6856407Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/216388Vendor Advisory
https://www.ibm.com/support/pages/node/6856407Vendor Advisory

Timeline

Published: Feb 29, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2021

CVE-2021-39107.5OctoRPKI crashes when encountering a repository that returns an invalid ROA (just an encoded NUL (\0) character).CVE-2021-391097.5The renderWidgetResource resource in Atlasian Atlasboard before version 1.1.9 allows remote attackers to read arbitrary files via a path tra CVE-2021-39116.5If the ROA that a repository returns contains too many bits for the IP address then OctoRPKI will crash.CVE-2021-391116.1The Editor plugin in Atlassian Jira Server and Data Center before version 8.5.18, from 8.6.0 before 8.13.10, and from version 8.14.0 before CVE-2021-391124.8Affected versions of Atlassian Jira Server and Data Center allow remote attackers to redirect users to a malicious URL via a reverse tabnapp CVE-2021-391137.5Affected versions of Atlassian Jira Server and Data Center allow anonymous remote attackers to continue to view cached content even after lo CVE-2021-391148.8Affected versions of Atlassian Confluence Server and Data Center allow users with a valid account on a Confluence Data Center instance to ex CVE-2021-391157.2Affected versions of Atlassian Jira Service Management Server and Data Center allow remote attackers with "Jira Administrators" access to ex CVE-2021-391165.5Affected versions of Atlassian Jira Server and Data Center allow remote attackers to impact the application's availability via a Denial of S CVE-2021-391174.8The AssociateFieldToScreens page in Atlassian Jira Server and Data Center before version 8.18.0 allows remote attackers to inject arbitrary CVE-2021-391185.3Affected versions of Atlassian Jira Server and Data Center allow remote attackers to discover the usernames and full names of users via an e CVE-2021-391195.3Affected versions of Atlassian Jira Server and Data Center allow users who have watched an issue to continue receiving updates on the issue