{"api_version":"1","generated_at":"2026-07-25T01:22:37+00:00","cve":"CVE-2021-39013","urls":{"html":"https://cve.report/CVE-2021-39013","api":"https://cve.report/api/cve/CVE-2021-39013.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2021-39013","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2021-39013"},"summary":{"title":"CVE-2021-39013","description":"IBM Cloud Pak for Security (CP4S) 1.7.2.0, 1.7.1.0, and 1.7.0.0 could allow an authenticated user to obtain sensitive information in HTTP responses that could be used in further attacks against the system. IBM X-Force ID: 213651.","state":"PUBLIC","assigner":"psirt@us.ibm.com","published_at":"2021-12-22 17:15:00","updated_at":"2021-12-28 16:32:00"},"problem_types":["CWE-200"],"metrics":[],"references":[{"url":"https://www.ibm.com/support/pages/node/6529200","name":"https://www.ibm.com/support/pages/node/6529200","refsource":"CONFIRM","tags":[],"title":"Security Bulletin: Cloud Pak for Security uses packages that are vulnerable to CVEs","mime":"text/html","httpstatus":"200","archivestatus":"404"},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/213651","name":"ibm-cp4s-cve202139013-info-disc (213651)","refsource":"XF","tags":[],"title":"IBM X-Force Exchange","mime":"text/html","httpstatus":"200","archivestatus":"404"},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-39013","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-39013","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2021","cve_id":"39013","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"ibm","cpe5":"cloud_pak_for_security","cpe6":"1.7.0.0","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2021","cve_id":"39013","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"ibm","cpe5":"cloud_pak_for_security","cpe6":"1.7.1.0","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2021","cve_id":"39013","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"ibm","cpe5":"cloud_pak_for_security","cpe6":"1.7.2.0","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2021","cve_id":"39013","vulnerable":"-1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"redhat","cpe5":"openshift","cpe6":"-","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"data_format":"MITRE","references":{"reference_data":[{"title":"IBM Security Bulletin 6529200 (Cloud Pak for Security)","name":"https://www.ibm.com/support/pages/node/6529200","url":"https://www.ibm.com/support/pages/node/6529200","refsource":"CONFIRM"},{"title":"X-Force Vulnerability Report","url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/213651","name":"ibm-cp4s-cve202139013-info-disc (213651)","refsource":"XF"}]},"data_version":"4.0","impact":{"cvssv3":{"TM":{"RC":"C","RL":"O","E":"U"},"BM":{"S":"U","AV":"N","A":"N","SCORE":"4.300","UI":"N","AC":"L","PR":"L","I":"N","C":"L"}}},"CVE_data_meta":{"DATE_PUBLIC":"2021-12-21T00:00:00","STATE":"PUBLIC","ID":"CVE-2021-39013","ASSIGNER":"psirt@us.ibm.com"},"data_type":"CVE","problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"Obtain Information"}]}]},"description":{"description_data":[{"value":"IBM Cloud Pak for Security (CP4S) 1.7.2.0, 1.7.1.0, and 1.7.0.0 could allow an authenticated user to obtain sensitive information in HTTP responses that could be used in further attacks against the system. IBM X-Force ID: 213651.","lang":"eng"}]},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"version":{"version_data":[{"version_value":"1.7.0.0"},{"version_value":"1.7.1.0"},{"version_value":"1.7.2.0"}]},"product_name":"Cloud Pak for Security"}]},"vendor_name":"IBM"}]}}},"nvd":{"publishedDate":"2021-12-22 17:15:00","lastModifiedDate":"2021-12-28 16:32:00","problem_types":["CWE-200"],"metrics":{"baseMetricV3":{"cvssV3":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE","baseScore":6.5,"baseSeverity":"MEDIUM"},"exploitabilityScore":2.8,"impactScore":3.6},"baseMetricV2":{"cvssV2":{"version":"2.0","vectorString":"AV:N/AC:L/Au:S/C:P/I:N/A:N","accessVector":"NETWORK","accessComplexity":"LOW","authentication":"SINGLE","confidentialityImpact":"PARTIAL","integrityImpact":"NONE","availabilityImpact":"NONE","baseScore":4},"severity":"MEDIUM","exploitabilityScore":8,"impactScore":2.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}},"configurations":{"CVE_data_version":"4.0","nodes":[{"operator":"AND","children":[{"operator":"OR","children":[],"cpe_match":[{"vulnerable":true,"cpe23Uri":"cpe:2.3:a:ibm:cloud_pak_for_security:1.7.0.0:*:*:*:*:*:*:*","cpe_name":[]},{"vulnerable":true,"cpe23Uri":"cpe:2.3:a:ibm:cloud_pak_for_security:1.7.1.0:*:*:*:*:*:*:*","cpe_name":[]},{"vulnerable":true,"cpe23Uri":"cpe:2.3:a:ibm:cloud_pak_for_security:1.7.2.0:*:*:*:*:*:*:*","cpe_name":[]}]},{"operator":"OR","children":[],"cpe_match":[{"vulnerable":false,"cpe23Uri":"cpe:2.3:a:redhat:openshift:-:*:*:*:*:*:*:*","cpe_name":[]}]}],"cpe_match":[]}]}},"legacy_mitre":{"record":{"CveYear":"2021","CveId":"39013","Ordinal":"214691","Title":"CVE-2021-39013","CVE":"CVE-2021-39013","Year":"2021"},"notes":[{"CveYear":"2021","CveId":"39013","Ordinal":"1","NoteData":"IBM Cloud Pak for Security (CP4S) 1.7.2.0, 1.7.1.0, and 1.7.0.0 could allow an authenticated user to obtain sensitive information in HTTP responses that could be used in further attacks against the system. IBM X-Force ID: 213651.","Type":"Description","Title":null},{"CveYear":"2021","CveId":"39013","Ordinal":"2","NoteData":"2021-12-22","Type":"Other","Title":"Published"},{"CveYear":"2021","CveId":"39013","Ordinal":"3","NoteData":"2021-12-22","Type":"Other","Title":"Modified"}]}}}