Read the docs
TI-2021-10457 Aliases CVE-2021-29785GHSA-rpjh-63xm-7922

IBM Security SOAR V42 and V43could allow a remote attacker to obtain sensitive…

Priority LOW 29Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
High
Impact type
—
Confidentiality · integrity · availability
High · None · None
Fix status
No fix listed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA.

Summary

IBM Security SOAR V42 and V43could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable HTTP Strict Transport Security. An attacker could exploit this vulnerability to obtain sensitive information using man in the middle techniques. IBM X-Force ID: 203169.

Why it matters now

EPSS 0.01299 70th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
IBMSecurity SOAR42; 43—No fix listedCNA
  • Security SOAR VendorIBM Affected 42; 43 Fixed in — No fix listed CNA

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:a:ibm:soar:*:*:*:*:*:*:*:*42.0.7058 to before 43.1.49VulnerableIBM
cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*not specified by NVDRunning onLinux
  • cpe:2.3:a:ibm:soar:*:*:*:*:*:*:*:* Versions 42.0.7058 to before 43.1.49 Vulnerable ·IBM
  • cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Linux

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2021-29785
  2. 2026-10-03 Alias added: GHSA-rpjh-63xm-7922

References

Patch 1

  • TI-2024-25593 IBM Security SOAR code execution CVSS 3.1HIGH 8.8
  • TI-2024-30668 IBM Security SOAR weak password recovery mechanism CVSS 3.1HIGH 8.1
  • TI-2020-03946 IBM Resilient SOAR 40 and earlier could disclose sensitive information by allowing a user to enumerate usernames. CVSS 3.1MEDIUM 5.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences