Vulnerabilities > CVE-2021-39011 - Information Exposure Through Log Files vulnerability in IBM Cloud PAK for Security 18.104.22.168/22.214.171.124
IBM Cloud Pak for Security (CP4S) 126.96.36.199 through 188.8.131.52 stores potentially sensitive information in log files that could be read by a privileged user. IBM X-Force ID: 213645.
Common Weakness Enumeration (CWE)
Common Attack Pattern Enumeration and Classification (CAPEC)
- Fuzzing and observing application log data/errors for application mapping An attacker sends random, malformed, or otherwise unexpected messages to a target application and observes the application's log or error messages returned. Fuzzing techniques involve sending random or malformed messages to a target and monitoring the target's response. The attacker does not initially know how a target will respond to individual messages but by attempting a large number of message variants they may find a variant that trigger's desired behavior. In this attack, the purpose of the fuzzing is to observe the application's log and error messages, although fuzzing a target can also sometimes cause the target to enter an unstable state, causing a crash. By observing logs and error messages, the attacker can learn details about the configuration of the target application and might be able to cause the target to disclose sensitive information.