IBM Cloud Automation Manager vulnerabilities

4 CVEs affecting IBM Cloud Automation Manager, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2019-4617, published 2020-03-16.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2019-4132, published 2019-08-29. Low severity, CVSS 3.3. EPSS: 0.4% chance of exploitation in the next 30 days. IBM Cloud Automation Manager 3.1.2 could allow a user to be impropertly redirected and obtain sensitive information rather than receive a 404 error message. IBM X-Force ID: 158274.
CVE-2019-4133, published 2019-08-29. Medium severity, CVSS 5.2. EPSS: 0.3% chance of exploitation in the next 30 days. IBM Cloud Automation Manager 3.1.2 could allow a malicious user on the client side (with access to client computer) to run a custom script. IBM X-Force ID: 158278.
CVE-2019-4617, published 2020-03-16. Medium severity, CVSS 4.4. EPSS: 0.3% chance of exploitation in the next 30 days. IBM Cloud Automation Manager 3.2.1.0 does not renew a session variable after a successful authentication which could lead to session fixation/hijacking vulnerability. This could force a user to…
CVE-2019-4616, published 2020-02-05. Low severity, CVSS 3.5. EPSS: 0.3% chance of exploitation in the next 30 days. IBM Cloud Automation Manager 3.2.1.0 does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie values by sending a http:// link to a user…