IBM Cloud Orchestrator Enterprise vulnerabilities

2 CVEs affecting IBM Cloud Orchestrator Enterprise, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2019-4398, published 2019-10-24.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2019-4397, published 2019-10-24. Medium severity, CVSS 6.5. EPSS: 1% chance of exploitation in the next 30 days. IBM Cloud Orchestrator and IBM Cloud Orchestrator Enterprise 2.5 through 2.5.0.9 and 2.4 through 2.4.0.5 stores sensitive information in URL parameters. This may lead to information disclosure if…
CVE-2019-4398, published 2019-10-24. Low severity, CVSS 3.3. EPSS: 0.3% chance of exploitation in the next 30 days. IBM Cloud Orchestrator and IBM Cloud Orchestrator Enterprise 2.5 through 2.5.0.9 and 2.4 through 2.4.0.5 could allow a local user to obtain sensitive information from SessionManagement cookies. IBM…