IBM Sterling Partner Engagement Manager JWT Secret Exposure Vulnerability

A vulnerability exists in IBM Sterling Partner Engagement Manager versions 6.1.0, 6.2.0, and 6.2.2, where the JSON Web Token (JWT) secret is publicly stored in Helm Charts instead of being secured as a Kubernetes secret. This flaw can lead to unauthorized access or manipulation of JWTs, potentially allowing for session hijacking or other security breaches.

Impact

The vulnerability allows for the exposure of sensitive JWT secrets, which could be exploited to manipulate or forge JWTs, leading to unauthorized access or actions within the application.

Remediation

Users can upgrade to the latest version of the IBM Sterling Partner Engagement Manager Helm Chart, where this issue has been addressed. Guidance on downloading the updated Helm Charts is available in the IBM Sterling Partner Engagement Manager documentation. Additionally, users should provide a valid, non-empty JWT secret key during deployment to ensure secure configurations.