Vulnerability CVE-2016-5959

Vulnerability Name:

CVE-2016-5959 (CCN-116136)

Assigned:

2016-06-29

Published:

2017-06-02

Updated:

2017-06-13

Summary:

IBM Security Privileged Identity Manager 2.0.2 and 2.1.0 stores sensitive information in URL parameters. This may lead to information disclosure if unauthorized parties have access to the URLs via server logs, referrer header or browser history. IBM X-Force ID: 116136.

CVSS v3 Severity:

5.3 Medium (CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)
4.6 Medium (Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:U/RL:O/RC:C)

Exploitability Metrics:	Attack Vector (AV): Network Attack Complexity (AC): Low Privileges Required (PR): None User Interaction (UI): None
Scope:	Scope (S): Unchanged
Impact Metrics:	Confidentiality (C): Low Integrity (I): None Availibility (A): None

3.7 Low (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N)
3.2 Low (CCN Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N/E:U/RL:O/RC:C)

Exploitability Metrics:	Attack Vector (AV): Network Attack Complexity (AC): High Privileges Required (PR): None User Interaction (UI): None
Scope:	Scope (S): Unchanged
Impact Metrics:	Confidentiality (C): Low Integrity (I): None Availibility (A): None

CVSS v2 Severity:

5.0 Medium (CVSS v2 Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N)

Exploitability Metrics:	Access Vector (AV): Network Access Complexity (AC): Low Authentication (Au): None
Impact Metrics:	Confidentiality (C): Partial Integrity (I): None Availibility (A): None

2.6 Low (CCN CVSS v2 Vector: AV:N/AC:H/Au:N/C:P/I:N/A:N)

Exploitability Metrics:	Access Vector (AV): Network Access Complexity (AC): High Athentication (Au): None
Impact Metrics:	Confidentiality (C): Partial Integrity (I): None Availibility (A): None

Vulnerability Type:

CWE-200

Vulnerability Consequences:

Obtain Information

References:

Source: MITRE
Type: CNA
CVE-2016-5959

Source: CCN
Type: IBM Security Bulletin 2003092 (Security Privileged Identity Manager)
Multiple Security vulnerabilities fixed in IBM Security Privileged Identity Manager

Source: CONFIRM
Type: Patch, Vendor Advisory
http://www.ibm.com/support/docview.wss?uid=swg22003092

Source: BID
Type: Third Party Advisory, VDB Entry
98829

Source: CCN
Type: BID-98829
IBM Security Privileged Identity Manager CVE-2016-5959 Information Disclosure Vulnerability

Source: MISC
Type: VDB Entry, Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/116136

Source: XF
Type: UNKNOWN
ibm-spim-cve20165959-info-disc(116136)

Vulnerable Configuration:

Configuration 1:

cpe:/a:ibm:security_privileged_identity_manager:2.0.2:*:*:*:*:*:*:*

OR cpe:/a:ibm:security_privileged_identity_manager:2.1:*:*:*:*:*:*:*

Configuration CCN 1:

cpe:/a:ibm:security_privileged_identity_manager:2.0.2:*:*:*:*:*:*:*

OR cpe:/a:ibm:security_privileged_identity_manager:2.1.0:*:*:*:*:*:*:*

Denotes that component is vulnerable

BACK