CVE-2017-1476

Опубликовано: 06 июн. 2018

Источник: nvd

CVSS3: 5.9

CVSS2: 4.3

EPSS Низкий

Описание

IBM Security Access Manager Appliance 7.0.0, 8.0.0 through 8.0.1.6, and 9.0.0 through 9.0.3.1 could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable HTTP Strict Transport Security. An attacker could exploit this vulnerability to obtain sensitive information using man in the middle techniques. IBM X-Force ID: 128610.

Ссылки

http://www.ibm.com/support/docview.wss?uid=swg22012310
Patch
Vendor Advisory
http://www.securityfocus.com/bid/104501
Third Party Advisory
VDB Entry
https://exchange.xforce.ibmcloud.com/vulnerabilities/128610
VDB Entry
Vendor Advisory
http://www.ibm.com/support/docview.wss?uid=swg22012310
Patch
Vendor Advisory
http://www.securityfocus.com/bid/104501
Third Party Advisory
VDB Entry
https://exchange.xforce.ibmcloud.com/vulnerabilities/128610
VDB Entry
Vendor Advisory

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:ibm:security_access_manager:*:*:*:*:*:*:*:*

Версия от 9.0.0 (включая) до 9.0.3.1 (включая)

Конфигурация 2

Одно из

cpe:2.3:a:ibm:security_access_manager_for_web:*:*:*:*:*:*:*:*

Версия от 7.0.0 (включая) до 7.0.0.32 (включая)

cpe:2.3:a:ibm:security_access_manager_for_web:*:*:*:*:*:*:*:*

Версия от 8.0.0 (включая) до 8.0.1.6 (включая)

Конфигурация 3

cpe:2.3:a:ibm:security_access_manager_for_mobile:*:*:*:*:*:*:*:*

Версия от 8.0.0 (включая) до 8.0.1.6 (включая)

EPSS

Процентиль: 47%

0.00238

Низкий

5.9 Medium

CVSS3

4.3 Medium

CVSS2

Дефекты

CWE-200

Связанные уязвимости

GHSA-gv2f-c27v-pchr