IBM Cloud Orchestrator and IBM Cloud Orchestrator Enterprise 2.5 through 2.5.0.9 and 2.4 through 2.4.0.5 stores sensitive information in URL

Affected versions

NVD version ranges (for catalog products). Add the product to your stack with a version and matching uses these.

• ibm cloud orchestrator2.4 and later · up to 2.4.0.5 inclusive
• ibm cloud orchestrator2.5 and later · up to 2.5.0.9 inclusive
• ibm cloud orchestrator enterprise2.4 and later · up to 2.4.0.5 inclusive
• ibm cloud orchestrator enterprise2.5 and later · up to 2.5.0.9 inclusive

Versions reported by the vendor

Affected version ranges reported by the assigning authority (ibm). Independent of NVD's CPE analysis and usually ahead of it.

• IBM Cloud Orchestrator

  • 2.4, 2.4.0.1, 2.4.0.2, 2.5, 2.5.0.1, 2.4.0.3, 2.5.0.2, 2.4.0.4, 2.5.0.3, 2.5.0.4, 2.4.0.5, 2.5.0.5 … (+4)affected

Other highest-scoring records for the same primary product.

• CVE-2019-4399IBM Cloud Orchestrator 2.4 through 2.4.0.5 and 2.5 through 2.5.0.9 uses weaker than expected cryptographic algorithms that could allow an at
  30Monitor
• CVE-2016-0204Open redirect vulnerability in IBM Cloud Orchestrator 2.4.x before 2.4.0 FP3 allows remote authenticated users to redirect users to arbitrar
  27Monitor
• CVE-2016-0203A vulnerability has been identified in the IBM Cloud Orchestrator task API.
  22Monitor
• CVE-2019-4461IBM Cloud Orchestrator 2.4 through 2.4.0.5 and 2.5 through 2.5.0.9 is vulnerable to HTTP Response Splitting caused by improper caching of co
  21Monitor
• CVE-2019-4396IBM Cloud Orchestrator 2.4 through 2.4.0.5 and 2.5 through 2.5.0.9 is vulnerable to HTTP response splitting attacks, caused by improper vali
  21Monitor
• CVE-2019-4459IBM Cloud Orchestrator and IBM Cloud Orchestrator Enterprise 2.5 through 2.5.0.9 and 2.4 through 2.4.0.5 is vulnerable to cross-site scripti
  21Monitor

FIRST EPSS daily score; only changes of 0.01 or more are recorded (step chart).

Root cause

The extension requests broader permissions than its function needs and sends the data it collects out for purposes beyond its stated function.

A representative example of this vulnerability class. Not the vendor's source code; it shows the faulty pattern and its fix.

1{2  "permissions": ["tabs", "<all_urls>"],3  "background": { "service_worker": "analytics.js" }4}

1{2  "permissions": ["activeTab"],3  "host_permissions": ["https://yildiz.example/*"]4}

Attack context

MITRE CAPEC attack patterns and ATT&CK techniques for this weakness class (CWE). A starting point for detection rules and threat hunting.