CVE-2021-38890

Опубликовано: 23 нояб. 2021

Источник: nvd

CVSS3: 5.9

CVSS3: 7.5

CVSS2: 5

EPSS Низкий

Описание

IBM Sterling Connect:Direct Web Services 1.0 and 6.0 uses an inadequate account lockout setting that could allow a remote attacker to brute force account credentials. IBM X-Force ID: 209507.

Ссылки

https://exchange.xforce.ibmcloud.com/vulnerabilities/209507
VDB Entry
Vendor Advisory
https://www.ibm.com/support/pages/node/6518586
Patch
Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/209507
VDB Entry
Vendor Advisory
https://www.ibm.com/support/pages/node/6518586
Patch
Vendor Advisory

Уязвимые конфигурации

Конфигурация 1

Одновременно

cpe:2.3:a:ibm:sterling_connect\:direct:*:*:*:*:*:*:*:*

Версия от 6.0.0 (включая) до 6.2.0.1 (исключая)

Одно из

cpe:2.3:o:ibm:aix:-:*:*:*:*:*:*:*

cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*

cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*

cpe:2.3:o:oracle:solaris:-:*:*:*:*:*:-:*

EPSS

Процентиль: 41%

0.00186

Низкий

5.9 Medium

CVSS3

7.5 High

CVSS3

5 Medium

CVSS2

Дефекты

CWE-307

Связанные уязвимости

GHSA-m882-7wv7-pwjj

github

около 4 лет назад

IBM Sterling Connect:Direct Web Services 1.0 and 6.0 uses an inadequate account lockout setting that could allow a remote attacker to brute force account credentials. IBM X-Force ID: 209507.

EPSS

Процентиль: 41%

0.00186

Низкий

5.9 Medium

CVSS3

7.5 High

CVSS3

5 Medium

CVSS2

Дефекты

CWE-307