CVE-2019-4631: IBM Security Secret Server 10.7 could allow a remote attacker to conduct phishing attacks, using an open redirect attack. By persuading a victim to visit a specially-crafted Web site, a remote atta...

Summary

IBM Security Secret Server 10.7 could allow a remote attacker to conduct phishing attacks, using an open redirect attack. By persuading a victim to visit a specially-crafted Web site, a remote attacker could exploit this vulnerability to spoof the URL displayed to redirect a user to a malicious Web ...

What to do

Update ibm security_secret_server to version 10.7.000059 or later.

Affected software

Vendor	Product	Affected versions
ibm	security_secret_server	< 10.7.000059 `cpe:2.3:a:ibm:security_secret_server::::::::`

Original advisory text

IBM Security Secret Server 10.7 could allow a remote attacker to conduct phishing attacks, using an open redirect attack. By persuading a victim to visit a specially-crafted Web site, a remote atta...

IBM Security Secret Server 10.7 could allow a remote attacker to conduct phishing attacks, using an open redirect attack. By persuading a victim to visit a specially-crafted Web site, a remote attacker could exploit this vulnerability to spoof the URL displayed to redirect a user to a malicious Web site that would appear to be trusted. This could allow the attacker to obtain highly sensitive information or conduct further attacks against the victim. IBM X-Force ID: 170001.

References

https://exchange.xforce.ibmcloud.com/vulnerabilities/170001 VDB Entry Vendor Advisory
https://www.ibm.com/support/pages/node/1283224 Patch Vendor Advisory