{"api_version":"1","generated_at":"2026-07-23T07:16:48+00:00","cve":"CVE-2019-4385","urls":{"html":"https://cve.report/CVE-2019-4385","api":"https://cve.report/api/cve/CVE-2019-4385.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2019-4385","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2019-4385"},"summary":{"title":"CVE-2019-4385","description":"IBM Spectrum Protect Plus 10.1.2 may display the vSnap CIFS password in the IBM Spectrum Protect Plus Joblog. This can result in an attacker gaining access to sensitive information as well as vSnap. IBM X-Force ID: 162173.","state":"PUBLIC","assigner":"psirt@us.ibm.com","published_at":"2019-06-19 14:15:00","updated_at":"2023-01-30 16:51:00"},"problem_types":["CWE-522"],"metrics":[],"references":[{"url":"http://www.securityfocus.com/bid/108899","name":"108899","refsource":"BID","tags":[],"title":"IBM Spectrum Protect Plus CVE-2019-4385 Local Information Disclosure Vulnerability","mime":"text/html","httpstatus":"200","archivestatus":"0"},{"url":"http://www.ibm.com/support/docview.wss?uid=ibm10886099","name":"http://www.ibm.com/support/docview.wss?uid=ibm10886099","refsource":"CONFIRM","tags":["Patch","Vendor Advisory"],"title":"Security Bulletin: Password exposure via job log in IBM Spectrum Protect Plus (CVE-2019-4385)","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/162173","name":"ibm-spectrum-cve20194385-info-disc (162173)","refsource":"XF","tags":["VDB Entry","Vendor Advisory"],"title":"IBM X-Force Exchange","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-4385","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-4385","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2019","cve_id":"4385","vulnerable":"1","versionEndIncluding":"10.1.2.303","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"ibm","cpe5":"spectrum_protect_plus","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"description":{"description_data":[{"lang":"eng","value":"IBM Spectrum Protect Plus 10.1.2 may display the vSnap CIFS password in the IBM Spectrum Protect Plus Joblog. This can result in an attacker gaining access to sensitive information as well as vSnap. IBM X-Force ID: 162173."}]},"references":{"reference_data":[{"title":"IBM Security Bulletin 886099 (Spectrum Protect Plus)","refsource":"CONFIRM","name":"http://www.ibm.com/support/docview.wss?uid=ibm10886099","url":"http://www.ibm.com/support/docview.wss?uid=ibm10886099"},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/162173","title":"X-Force Vulnerability Report","name":"ibm-spectrum-cve20194385-info-disc (162173)","refsource":"XF"},{"refsource":"BID","name":"108899","url":"http://www.securityfocus.com/bid/108899"}]},"data_version":"4.0","problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"Obtain Information"}]}]},"CVE_data_meta":{"ID":"CVE-2019-4385","STATE":"PUBLIC","ASSIGNER":"psirt@us.ibm.com","DATE_PUBLIC":"2019-06-17T00:00:00"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"version":{"version_data":[{"version_value":"10.1.2"}]},"product_name":"Spectrum Protect Plus"}]},"vendor_name":"IBM"}]}},"impact":{"cvssv3":{"BM":{"I":"N","C":"H","S":"C","SCORE":"5.900","AV":"L","PR":"N","AC":"H","A":"N","UI":"N"},"TM":{"RC":"C","E":"U","RL":"O"}}},"data_type":"CVE","data_format":"MITRE"},"nvd":{"publishedDate":"2019-06-19 14:15:00","lastModifiedDate":"2023-01-30 16:51:00","problem_types":["CWE-522"],"metrics":{"baseMetricV3":{"cvssV3":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE","baseScore":6.5,"baseSeverity":"MEDIUM"},"exploitabilityScore":2,"impactScore":4},"baseMetricV2":{"cvssV2":{"version":"2.0","vectorString":"AV:L/AC:L/Au:N/C:P/I:N/A:N","accessVector":"LOCAL","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"NONE","availabilityImpact":"NONE","baseScore":2.1},"severity":"LOW","exploitabilityScore":3.9,"impactScore":2.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}},"configurations":{"CVE_data_version":"4.0","nodes":[{"operator":"OR","children":[],"cpe_match":[{"vulnerable":true,"cpe23Uri":"cpe:2.3:a:ibm:spectrum_protect_plus:*:*:*:*:*:*:*:*","versionStartIncluding":"10.1.2.219","versionEndIncluding":"10.1.2.303","cpe_name":[]}]}]}},"legacy_mitre":{"record":{"CveYear":"2019","CveId":"4385","Ordinal":"141996","Title":"CVE-2019-4385","CVE":"CVE-2019-4385","Year":"2019"},"notes":[{"CveYear":"2019","CveId":"4385","Ordinal":"1","NoteData":"IBM Spectrum Protect Plus 10.1.2 may display the vSnap CIFS password in the IBM Spectrum Protect Plus Joblog. This can result in an attacker gaining access to sensitive information as well as vSnap. IBM X-Force ID: 162173.","Type":"Description","Title":null},{"CveYear":"2019","CveId":"4385","Ordinal":"2","NoteData":"2019-06-19","Type":"Other","Title":"Published"},{"CveYear":"2019","CveId":"4385","Ordinal":"3","NoteData":"2019-06-27","Type":"Other","Title":"Modified"}]}}}