High severity · published Jun 26, 2019
CVE-2019-4235
IBM PureApplication System 2.2.3.0 through 2.2.5.3 does not require that users should have strong passwords by default, which makes it easier for attackers to compromise user…
7.5
CVSS
1.5%
EPSS
No
On KEV
Description
IBM PureApplication System 2.2.3.0 through 2.2.5.3 does not require that users should have strong passwords by default, which makes it easier for attackers to compromise user accounts. IBM X-Force ID: 159417.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.5% · higher than 74% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
PS
Pureapplication System · Ibm
2.2.3.0 through 2.2.5.3 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2019-4235
CVE.org
https://www.cve.org/CVERecord?id=CVE-2019-4235
VDB Entry
https://exchange.xforce.ibmcloud.com/vulnerabilities/159417
Patch
https://www-01.ibm.com/support/docview.wss?uid=ibm10885602
More from Pureapplication System
9.8
CVE-2014-7169
GNU Bourne-Again Shell (Bash) Arbitrary Code Execution Vulnerability
9.8
CVE-2014-6271
GNU Bourne-Again Shell (Bash) Arbitrary Code Execution Vulnerability
8.8
CVE-2019-4224
IBM PureApplication System 2.2.3.0 through 2.2.5.3 is vulnerable to SQL injection
7.8
CVE-2019-4241
IBM PureApplication System 2.2.3.0 through 2.2.5.3 could allow an authenticated user with local access to bypass authentication and obtain administrative access
4.4
CVE-2019-4225
IBM PureApplication System 2.2.3.0 through 2.2.5.3 stores potentially sensitive information in log files that could be read by a local user