5.5
CVE-2023-32338
- EPSS 0.02%
- Veröffentlicht 05.09.2023 00:15:07
- Zuletzt bearbeitet 21.11.2024 08:03:08
- Quelle psirt@us.ibm.com
- CVE-Watchlists
- Unerledigt
LoginIBM Sterling Secure Proxy information disclosure
IBM Sterling Secure Proxy and IBM Sterling External Authentication Server 6.0.3 and 6.1.0 stores user credentials in plain clear text which can be read by a local user with container access. IBM X-Force ID: 255585.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Ibm ≫ Sterling External Authentication Server Version6.0.3.0
Ibm ≫ Sterling External Authentication Server Version6.1.0
Ibm ≫ Sterling Secure Proxy Version6.0.3
Ibm ≫ Sterling Secure Proxy Version6.1.0
| Typ | Quelle | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 0.02% | 0.039 |
| Quelle | Base Score | Exploit Score | Impact Score | Vector String |
|---|---|---|---|---|
| nvd@nist.gov | 5.5 | 1.8 | 3.6 |
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
|
| psirt@us.ibm.com | 5.1 | 1.4 | 3.6 |
CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
|
CWE-522 Insufficiently Protected Credentials
The product transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval.