Vulnerability in IBM Powervc
CVE-2014-3093
IBM PowerVC 1.2.0 before FP3 and 1.2.1 before FP2 uses cleartext passwords in (1) api-paste.ini, (2) debug logs, (3) the installation process, (4) environment checks, (5) powervc-ldap-config, (6) powervc-restore, and (7) powervc-diag, which allows local users to obtain sensitive information by entering a ps command or reading a file.
Vulnerability class: POODLE (CVE-2014-3566)
EPSS: 0.003 (25.5th percentile) — read the EPSS interpretation.
Affected products
- Ibm Powervc — versions 1.2.0.0, 1.2.0.1, 1.2.0.2
- N/a — versions n/a
Weakness classification (CWE)
References
- psirt@us.ibm.com (x_refsource_CONFIRM, Vendor Advisory)
- psirt@us.ibm.com (vdb-entry, x_refsource_BID)
- psirt@us.ibm.com (vdb-entry, x_refsource_XF)