Vulnerability CVE-2016-6029 - CERT Civis.Net

Vulnerability Name:

CVE-2016-6029

Assigned:

2016-06-29

Published:

2017-08-14

Updated:

2017-08-20

Summary:

IBM Emptoris Strategic Supply Management Platform 10.0 and 10.1 could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable HTTP Strict Transport Security. An attacker could exploit this vulnerability to obtain sensitive information using man in the middle techniques. IBM X-Force ID: 116881.

CVSS v3 Severity:

5.9 Medium (CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N)

Exploitability Metrics:	Attack Vector (AV): Network Attack Complexity (AC): High Privileges Required (PR): None User Interaction (UI): None
Scope:	Scope (S): Unchanged
Impact Metrics:	Confidentiality (C): High Integrity (I): None Availibility (A): None

3.7 Low (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N)

Exploitability Metrics:	Attack Vector (AV): Network Attack Complexity (AC): High Privileges Required (PR): None User Interaction (UI): None
Scope:	Scope (S): Unchanged
Impact Metrics:	Confidentiality (C): Low Integrity (I): None Availibility (A): None

CVSS v2 Severity:

4.3 Medium (CVSS v2 Vector: AV:N/AC:M/Au:N/C:P/I:N/A:N)

Exploitability Metrics:	Access Vector (AV): Network Access Complexity (AC): Medium Authentication (Au): None
Impact Metrics:	Confidentiality (C): Partial Integrity (I): None Availibility (A): None

4.3 Medium (CCN CVSS v2 Vector: AV:N/AC:M/Au:N/C:P/I:N/A:N)

Exploitability Metrics:	Access Vector (AV): Network Access Complexity (AC): Medium Athentication (Au): None
Impact Metrics:	Confidentiality (C): Partial Integrity (I): None Availibility (A): None

Vulnerability Type:

References:

Source: MITRE
Type: CNA
CVE-2016-6029

Source: CONFIRM
Type: Patch, Vendor Advisory
http://www.ibm.com/support/docview.wss?uid=swg22006799

Source: MISC
Type: VDB Entry, Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/116881

Vulnerable Configuration:

Configuration 1:

cpe:/a:ibm:emptoris_strategic_supply_management:10.0.0.0:*:*:*:*:*:*:*

OR cpe:/a:ibm:emptoris_strategic_supply_management:10.0.0.1:*:*:*:*:*:*:*

OR cpe:/a:ibm:emptoris_strategic_supply_management:10.0.0.2:*:*:*:*:*:*:*

OR cpe:/a:ibm:emptoris_strategic_supply_management:10.0.0.3:*:*:*:*:*:*:*

OR cpe:/a:ibm:emptoris_strategic_supply_management:10.0.1.0:*:*:*:*:*:*:*

OR cpe:/a:ibm:emptoris_strategic_supply_management:10.0.1.1:*:*:*:*:*:*:*

OR cpe:/a:ibm:emptoris_strategic_supply_management:10.0.1.2:*:*:*:*:*:*:*

OR cpe:/a:ibm:emptoris_strategic_supply_management:10.0.1.3:*:*:*:*:*:*:*

OR cpe:/a:ibm:emptoris_strategic_supply_management:10.0.1.4:*:*:*:*:*:*:*

OR cpe:/a:ibm:emptoris_strategic_supply_management:10.0.2.0:*:*:*:*:*:*:*

OR cpe:/a:ibm:emptoris_strategic_supply_management:10.0.2.1:*:*:*:*:*:*:*

OR cpe:/a:ibm:emptoris_strategic_supply_management:10.0.2.2:*:*:*:*:*:*:*

OR cpe:/a:ibm:emptoris_strategic_supply_management:10.0.2.3:*:*:*:*:*:*:*

OR cpe:/a:ibm:emptoris_strategic_supply_management:10.0.2.4:*:*:*:*:*:*:*

OR cpe:/a:ibm:emptoris_strategic_supply_management:10.0.2.5:*:*:*:*:*:*:*

OR cpe:/a:ibm:emptoris_strategic_supply_management:10.0.2.6:*:*:*:*:*:*:*

OR cpe:/a:ibm:emptoris_strategic_supply_management:10.0.2.7:*:*:*:*:*:*:*

OR cpe:/a:ibm:emptoris_strategic_supply_management:10.0.2.8:*:*:*:*:*:*:*

OR cpe:/a:ibm:emptoris_strategic_supply_management:10.0.2.9:*:*:*:*:*:*:*

OR cpe:/a:ibm:emptoris_strategic_supply_management:10.0.2.10:*:*:*:*:*:*:*

OR cpe:/a:ibm:emptoris_strategic_supply_management:10.0.2.11:*:*:*:*:*:*:*

OR cpe:/a:ibm:emptoris_strategic_supply_management:10.0.2.12:*:*:*:*:*:*:*

OR cpe:/a:ibm:emptoris_strategic_supply_management:10.0.2.13:*:*:*:*:*:*:*

OR cpe:/a:ibm:emptoris_strategic_supply_management:10.0.2.14:*:*:*:*:*:*:*

OR cpe:/a:ibm:emptoris_strategic_supply_management:10.0.2.15:*:*:*:*:*:*:*

OR cpe:/a:ibm:emptoris_strategic_supply_management:10.0.4.0:*:*:*:*:*:*:*

OR cpe:/a:ibm:emptoris_strategic_supply_management:10.1.0.0:*:*:*:*:*:*:*

OR cpe:/a:ibm:emptoris_strategic_supply_management:10.1.0.1:*:*:*:*:*:*:*

OR cpe:/a:ibm:emptoris_strategic_supply_management:10.1.0.2:*:*:*:*:*:*:*

OR cpe:/a:ibm:emptoris_strategic_supply_management:10.1.0.3:*:*:*:*:*:*:*

OR cpe:/a:ibm:emptoris_strategic_supply_management:10.1.0.4:*:*:*:*:*:*:*

OR cpe:/a:ibm:emptoris_strategic_supply_management:10.1.0.5:*:*:*:*:*:*:*

OR cpe:/a:ibm:emptoris_strategic_supply_management:10.1.0.6:*:*:*:*:*:*:*

OR cpe:/a:ibm:emptoris_strategic_supply_management:10.1.0.7:*:*:*:*:*:*:*

OR cpe:/a:ibm:emptoris_strategic_supply_management:10.1.0.8:*:*:*:*:*:*:*

OR cpe:/a:ibm:emptoris_strategic_supply_management:10.1.0.9:*:*:*:*:*:*:*

OR cpe:/a:ibm:emptoris_strategic_supply_management:10.1.0.10:*:*:*:*:*:*:*

OR cpe:/a:ibm:emptoris_strategic_supply_management:10.1.1.0:*:*:*:*:*:*:*

OR cpe:/a:ibm:emptoris_strategic_supply_management:10.1.1.1:*:*:*:*:*:*:*

OR cpe:/a:ibm:emptoris_strategic_supply_management:10.1.1.2:*:*:*:*:*:*:*

OR cpe:/a:ibm:emptoris_strategic_supply_management:10.1.1.3:*:*:*:*:*:*:*

OR cpe:/a:ibm:emptoris_strategic_supply_management:10.1.1.4:*:*:*:*:*:*:*

OR cpe:/a:ibm:emptoris_strategic_supply_management:10.1.1.5:*:*:*:*:*:*:*

OR cpe:/a:ibm:emptoris_strategic_supply_management:10.1.1.6:*:*:*:*:*:*:*

OR cpe:/a:ibm:emptoris_strategic_supply_management:10.1.1.7:*:*:*:*:*:*:*

OR cpe:/a:ibm:emptoris_strategic_supply_management:10.1.1.8:*:*:*:*:*:*:*

Denotes that component is vulnerable