CVE-2019-4072

Published: May 9, 2019Modified: Jun 17, 2026

6.3

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Exploitability: 2.8 / Impact: 3.4

Source: NVD

Description

IBM Tivoli Storage Productivity Center (IBM Spectrum Control Standard Edition 5.2.1 through 5.2.17) allows users to remain idle within the application even when a user has logged out. Utilizing the application back button users can remain logged in as the current user for a short period of time, therefore users are presented with information for Spectrum Control Application. IBM X-Force ID: 157064.

Affected (3)

Products: Ibm: Spectrum Control, Tivoli Storage Productivity Center

2 products

Spectrum Control

Tivoli Storage Productivity Center

Configuration A

3 vulnerable

Vulnerable Software	Affected Versions
Ibm Spectrum Control	From 5.2.8 to 5.2.17.2
Ibm Spectrum Control	From 5.3.0 to 5.3.1
Ibm Tivoli Storage Productivity Center	From 5.2.0 to 5.2.7.1

Related CWEs

Insufficient Session Expiration

According to WASC, "Insufficient Session Expiration is when a web site permits an attacker to reuse old session credentials or session IDs for authorization."

References (4)

http://www.ibm.com/support/docview.wss?uid=ibm10873036

Source: psirt@us.ibm.com

Vendor Advisory

https://exchange.xforce.ibmcloud.com/vulnerabilities/157064

Source: psirt@us.ibm.com

VDB EntryVendor Advisory

http://www.ibm.com/support/docview.wss?uid=ibm10873036

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

https://exchange.xforce.ibmcloud.com/vulnerabilities/157064

Source: af854a3a-2127-422b-91ae-364da2661108

VDB EntryVendor Advisory

Timeline

No history available yet.