5.4
Medium
CVE-2019-4459 IBM Cloud Orchestrator and IBM Cloud Orchestrator Enterprise 2.5 through 2.5.0.9 and 2.4 through 2.4.0.5 is vulnerable…
Description
IBM Cloud Orchestrator and IBM Cloud Orchestrator Enterprise 2.5 through 2.5.0.9 and 2.4 through 2.4.0.5 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 163656.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Cloud Orchestrator 2.5 | 2.5 → 2.5.0.9 | No fix stated |
| Cloud Orchestrator 2.4 | 2.4 → 2.4.0.5 | No fix stated |
Other CVEs of Cloud Orchestrator
The 10 CVEs of Cloud Orchestrator →
CVE-2019-4400
IBM Cloud Orchestrator 2.4 through 2.4.0.5 and 2.5 through 2.5.0.9 could allow a remote attacker to traverse directories…
4.3
Medium
CVE-2019-4461
IBM Cloud Orchestrator 2.4 through 2.4.0.5 and 2.5 through 2.5.0.9 is vulnerable to HTTP Response Splitting caused by…
5.4
Medium
CVE-2019-4396
IBM Cloud Orchestrator 2.4 through 2.4.0.5 and 2.5 through 2.5.0.9 is vulnerable to HTTP response splitting attacks,…
5.4
Medium
CVE-2019-4399
IBM Cloud Orchestrator 2.4 through 2.4.0.5 and 2.5 through 2.5.0.9 uses weaker than expected cryptographic algorithms…
5.9
Medium