2.4
CVE-2016-9703
- EPSS 0.06%
- Veröffentlicht 01.02.2017 22:59:01
- Zuletzt bearbeitet 20.04.2025 01:37:25
- Quelle psirt@us.ibm.com
- Teams Watchlist Login
- Unerledigt Login
IBM Security Identity Manager Virtual Appliance does not invalidate session tokens which could allow an unauthorized user with physical access to the work station to obtain sensitive information.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Ibm ≫ Security Identity Manager Virtual Appliance Version7.0.0.0
Ibm ≫ Security Identity Manager Virtual Appliance Version7.0.0.1
Ibm ≫ Security Identity Manager Virtual Appliance Version7.0.0.2
Ibm ≫ Security Identity Manager Virtual Appliance Version7.0.0.3
Ibm ≫ Security Identity Manager Virtual Appliance Version7.0.1.0
Ibm ≫ Security Identity Manager Virtual Appliance Version7.0.1.1
Ibm ≫ Security Identity Manager Virtual Appliance Version7.0.1.2
Ibm ≫ Security Identity Manager Virtual Appliance Version7.0.1.3
Ibm ≫ Security Identity Manager Virtual Appliance Version7.0.1.4
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
| Typ | Quelle | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 0.06% | 0.164 |
| Quelle | Base Score | Exploit Score | Impact Score | Vector String |
|---|---|---|---|---|
| nvd@nist.gov | 2.4 | 0.9 | 1.4 |
CVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
|
| nvd@nist.gov | 2.1 | 3.9 | 2.9 |
AV:L/AC:L/Au:N/C:P/I:N/A:N
|
CWE-384 Session Fixation
Authenticating a user, or otherwise establishing a new user session, without invalidating any existing session identifier gives an attacker the opportunity to steal authenticated sessions.