{"id":"CVE-2019-4397","state":"PUBLISHED","title":"IBM Cloud Orchestrator and IBM Cloud Orchestrator Enterprise 2.5 through 2.5.0.9 and 2.4 through 2.4.0.5 stores sensitive information in URL parameters. This may lead to informatio","description":"IBM Cloud Orchestrator and IBM Cloud Orchestrator Enterprise 2.5 through 2.5.0.9 and 2.4 through 2.4.0.5 stores sensitive information in URL parameters. This may lead to information disclosure if unauthorized parties have access to the URLs via server logs, referrer header or browser history. IBM X-Force ID: 162239","publishedAt":"2019-10-24T12:00:37.660Z","updatedAt":"2024-09-17T01:01:14.329Z","severity":{"score":5.3,"label":"Medium","version":"3.0","vector":"CVSS:3.0/AC:H/UI:N/S:U/PR:L/C:H/A:N/I:N/AV:N/RL:O/RC:C/E:U","source":"ibm"},"assigner":"ibm","products":["IBM Cloud Orchestrator"],"affected":[{"vendor":"IBM","product":"Cloud Orchestrator","versions":[{"version":"2.4","status":"affected"},{"version":"2.4.0.1","status":"affected"},{"version":"2.4.0.2","status":"affected"},{"version":"2.5","status":"affected"},{"version":"2.5.0.1","status":"affected"},{"version":"2.4.0.3","status":"affected"},{"version":"2.5.0.2","status":"affected"},{"version":"2.4.0.4","status":"affected"},{"version":"2.5.0.3","status":"affected"},{"version":"2.5.0.4","status":"affected"},{"version":"2.4.0.5","status":"affected"},{"version":"2.5.0.5","status":"affected"},{"version":"2.5.0.6","status":"affected"},{"version":"2.5.0.7","status":"affected"},{"version":"2.5.0.8","status":"affected"},{"version":"2.5.0.9","status":"affected"}]}],"references":["https://www.ibm.com/support/pages/node/1077147","https://exchange.xforce.ibmcloud.com/vulnerabilities/162239"],"weaknesses":[],"ingestedAt":"2026-10-29T19:46:01.452Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2019/4xxx/CVE-2019-4397.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.1","cveMetadata":{"cveId":"CVE-2019-4397","state":"PUBLISHED","datePublished":"2019-10-24T12:00:37.660Z","dateUpdated":"2024-09-17T01:01:14.329Z","assignerShortName":"ibm","assignerOrgId":"9a959283-ebb5-44b6-b705-dcc2bbced522","dateReserved":"2019-01-03T00:00:00.000Z"},"containers":{"cna":{"descriptions":[{"lang":"en","value":"IBM Cloud Orchestrator and IBM Cloud Orchestrator Enterprise 2.5 through 2.5.0.9 and 2.4 through 2.4.0.5 stores sensitive information in URL parameters. This may lead to information disclosure if unauthorized parties have access to the URLs via server logs, referrer header or browser history. IBM X-Force ID: 162239"}],"affected":[{"vendor":"IBM","product":"Cloud Orchestrator","versions":[{"version":"2.4","status":"affected"},{"version":"2.4.0.1","status":"affected"},{"version":"2.4.0.2","status":"affected"},{"version":"2.5","status":"affected"},{"version":"2.5.0.1","status":"affected"},{"version":"2.4.0.3","status":"affected"},{"version":"2.5.0.2","status":"affected"},{"version":"2.4.0.4","status":"affected"},{"version":"2.5.0.3","status":"affected"},{"version":"2.5.0.4","status":"affected"},{"version":"2.4.0.5","status":"affected"},{"version":"2.5.0.5","status":"affected"},{"version":"2.5.0.6","status":"affected"},{"version":"2.5.0.7","status":"affected"},{"version":"2.5.0.8","status":"affected"},{"version":"2.5.0.9","status":"affected"}]}],"references":[{"url":"https://www.ibm.com/support/pages/node/1077147","tags":["x_refsource_CONFIRM"]},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/162239","name":"ibm-co-cve20194397-info-disc (162239)","tags":["vdb-entry","x_refsource_XF"]}],"metrics":[{"cvssV3_0":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","exploitCodeMaturity":"UNPROVEN","integrityImpact":"NONE","privilegesRequired":"LOW","remediationLevel":"OFFICIAL_FIX","reportConfidence":"CONFIRMED","scope":"UNCHANGED","temporalScore":4.6,"temporalSeverity":"MEDIUM","userInteraction":"NONE","vectorString":"CVSS:3.0/AC:H/UI:N/S:U/PR:L/C:H/A:N/I:N/AV:N/RL:O/RC:C/E:U","version":"3.0"}}],"problemTypes":[{"descriptions":[{"description":"Obtain Information","lang":"en","type":"text"}]}],"providerMetadata":{"shortName":"ibm","dateUpdated":"2019-10-24T12:00:37.000Z","orgId":"9a959283-ebb5-44b6-b705-dcc2bbced522"},"datePublic":"2019-10-23T00:00:00.000Z","x_legacyV4Record":{"CVE_data_meta":{"ASSIGNER":"psirt@us.ibm.com","DATE_PUBLIC":"2019-10-23T00:00:00","ID":"CVE-2019-4397","STATE":"PUBLIC"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"Cloud Orchestrator","version":{"version_data":[{"version_value":"2.4"},{"version_value":"2.4.0.1"},{"version_value":"2.4.0.2"},{"version_value":"2.5"},{"version_value":"2.5.0.1"},{"version_value":"2.4.0.3"},{"version_value":"2.5.0.2"},{"version_value":"2.4.0.4"},{"version_value":"2.5.0.3"},{"version_value":"2.5.0.4"},{"version_value":"2.4.0.5"},{"version_value":"2.5.0.5"},{"version_value":"2.5.0.6"},{"version_value":"2.5.0.7"},{"version_value":"2.5.0.8"},{"version_value":"2.5.0.9"}]}}]},"vendor_name":"IBM"}]}},"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"IBM Cloud Orchestrator and IBM Cloud Orchestrator Enterprise 2.5 through 2.5.0.9 and 2.4 through 2.4.0.5 stores sensitive information in URL parameters. This may lead to information disclosure if unauthorized parties have access to the URLs via server logs, referrer header or browser history. IBM X-Force ID: 162239"}]},"impact":{"cvssv3":{"BM":{"A":"N","AC":"H","AV":"N","C":"H","I":"N","PR":"L","S":"U","UI":"N"},"TM":{"E":"U","RC":"C","RL":"O"}}},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"Obtain Information"}]}]},"references":{"reference_data":[{"name":"https://www.ibm.com/support/pages/node/1077147","refsource":"CONFIRM","title":"IBM Security Bulletin 1077147 (Cloud Orchestrator)","url":"https://www.ibm.com/support/pages/node/1077147"},{"name":"ibm-co-cve20194397-info-disc (162239)","refsource":"XF","title":"X-Force Vulnerability Report","url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/162239"}]}}},"adp":[{"title":"CVE Program Container","references":[{"url":"https://www.ibm.com/support/pages/node/1077147","tags":["x_refsource_CONFIRM","x_transferred"]},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/162239","name":"ibm-co-cve20194397-info-disc (162239)","tags":["vdb-entry","x_refsource_XF","x_transferred"]}],"providerMetadata":{"shortName":"CVE","orgId":"af854a3a-2127-422b-91ae-364da2661108","dateUpdated":"2024-08-04T19:33:38.291Z"}}]}}}