2.4
CVE-2016-9703
- EPSS 0.35%
- Veröffentlicht 01.02.2017 22:59:01
- Zuletzt bearbeitet 13.05.2026 00:24:29
- Quelle psirt@us.ibm.com
- CVE-Watchlists
- Unerledigt
LoginIBM Security Identity Manager Virtual Appliance does not invalidate session tokens which could allow an unauthorized user with physical access to the work station to obtain sensitive information.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Ibm ≫ Security Identity Manager Virtual Appliance Version7.0.0.0
Ibm ≫ Security Identity Manager Virtual Appliance Version7.0.0.1
Ibm ≫ Security Identity Manager Virtual Appliance Version7.0.0.2
Ibm ≫ Security Identity Manager Virtual Appliance Version7.0.0.3
Ibm ≫ Security Identity Manager Virtual Appliance Version7.0.1.0
Ibm ≫ Security Identity Manager Virtual Appliance Version7.0.1.1
Ibm ≫ Security Identity Manager Virtual Appliance Version7.0.1.2
Ibm ≫ Security Identity Manager Virtual Appliance Version7.0.1.3
Ibm ≫ Security Identity Manager Virtual Appliance Version7.0.1.4
| Typ | Quelle | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 0.35% | 0.262 |
| Quelle | Base Score | Exploit Score | Impact Score | Vector String |
|---|---|---|---|---|
| nvd@nist.gov | 2.4 | 0.9 | 1.4 |
CVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
|
| nvd@nist.gov | 2.1 | 3.9 | 2.9 |
AV:L/AC:L/Au:N/C:P/I:N/A:N
|
CWE-384 Session Fixation
Authenticating a user, or otherwise establishing a new user session, without invalidating any existing session identifier gives an attacker the opportunity to steal authenticated sessions.
http://www.ibm.com/support/docview.wss?uid=swg21996761
http://www.securityfocus.com/bid/95327
http://www.securitytracker.com/id/1037765