Information disclosure in IBM Tivoli Event Pump

CVE-2012-0742

IBM Tivoli Event Pump 4.2.2, when the LOG_REQUESTS and VALIDATE_SOAP_USERS options are enabled, places credentials into the AOPSCLOG (aka AOPLOG) data set, which allows local users to obtain sensitive information by reading the data.

Vulnerability class: Information Disclosure

EPSS: 0.003 (21.7th percentile) — read the EPSS interpretation.

Affected products

Ibm Tivoli_event_pump — versions 4.2.2
N/a — versions n/a

Weakness classification (CWE)

CWE-200 — Information Disclosure

References

psirt@us.ibm.com (vdb-entry, x_refsource_XF)
psirt@us.ibm.com (vendor-advisory, Vendor Advisory, x_refsource_AIXAPAR)