{"id":"CVE-2021-39013","aliases":["EUVD-2021-25450","GHSA-f59c-vrcv-x2gg"],"status":"published","title":"IBM Cloud Pak for Security (CP4S) 1.7.2.0, 1.7.1.0, and 1.7.0.0 could allow an authenticated user...","description":"IBM Cloud Pak for Security (CP4S) 1.7.2.0, 1.7.1.0, and 1.7.0.0 could allow an authenticated user to obtain sensitive information in HTTP responses that could be used in further attacks against the system. IBM X-Force ID: 213651.","severity":{"version":"3.0","score":4.3,"vector":"CVSS:3.0/S:U/AV:N/A:N/UI:N/AC:L/PR:L/I:N/C:L/RC:C/RL:O/E:U","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00811,"percentile":0.57248,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-200"],"published":"2021-12-22T16:50:09Z","modified":"2026-06-17T04:02:58Z","products":[{"vendor":"ibm","product":"cloud pak for security"},{"vendor":"ibm","product":"cloud_pak_for_security"}],"references":[{"url":"https://www.ibm.com/support/pages/node/6529200","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory"]},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/213651","tags":["vdb-entry","x_refsource_XF","x_transferred","VDB Entry","Vendor Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-39013"},{"url":"https://github.com/advisories/GHSA-f59c-vrcv-x2gg"}],"sources":{"cve":[{"id":"CVE-2021-39013","description":"IBM Cloud Pak for Security (CP4S) 1.7.2.0, 1.7.1.0, and 1.7.0.0 could allow an authenticated user to obtain sensitive information in HTTP responses that could be used in further attacks against the system. IBM X-Force ID: 213651.","status":"published","published":"2021-12-22T16:50:09.95Z","modified":"2024-09-17T00:22:03.701Z","cvss":[{"version":"3.0","score":4.3,"vector":"CVSS:3.0/S:U/AV:N/A:N/UI:N/AC:L/PR:L/I:N/C:L/RC:C/RL:O/E:U","level":"medium","assessor":"cna"}],"updated_at":"2026-11-02T14:33:09.540052Z"}],"euvd":[{"id":"EUVD-2021-25450","description":"IBM Cloud Pak for Security (CP4S) 1.7.2.0, 1.7.1.0, and 1.7.0.0 could allow an authenticated user to obtain sensitive information in HTTP responses that could be used in further attacks against the system. IBM X-Force ID: 213651.","status":"published","published":"2021-12-22T16:50:09Z","modified":"2024-09-17T00:22:03Z","cvss":[{"version":"3.0","score":4.3,"vector":"CVSS:3.0/S:U/AV:N/A:N/UI:N/AC:L/PR:L/I:N/C:L/RC:C/RL:O/E:U","level":"medium"}],"updated_at":"2026-11-03T00:28:59.742061Z"}],"ghsa":[{"id":"GHSA-f59c-vrcv-x2gg","title":"IBM Cloud Pak for Security (CP4S) 1.7.2.0, 1.7.1.0, and 1.7.0.0 could allow an authenticated user...","description":"IBM Cloud Pak for Security (CP4S) 1.7.2.0, 1.7.1.0, and 1.7.0.0 could allow an authenticated user to obtain sensitive information in HTTP responses that could be used in further attacks against the system. IBM X-Force ID: 213651.","status":"published","published":"2021-12-23T00:01:31Z","modified":"2023-02-03T05:03:14Z","cwes":["CWE-200"],"updated_at":"2026-11-02T14:53:19.085994Z"}],"nvd":[{"id":"CVE-2021-39013","description":"IBM Cloud Pak for Security (CP4S) 1.7.2.0, 1.7.1.0, and 1.7.0.0 could allow an authenticated user to obtain sensitive information in HTTP responses that could be used in further attacks against the system. IBM X-Force ID: 213651.","status":"published","published":"2021-12-22T17:15:09.063Z","modified":"2026-06-17T04:02:58.137Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"primary"},{"version":"3.0","score":4.3,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"secondary"},{"version":"2.0","score":4,"vector":"AV:N/AC:L/Au:S/C:P/I:N/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T14:07:02.566991Z"}]}}