What is the CVSS score of CVE-2012-4832?

CVE-2012-4832 has a CVSS 2.0 base score of 1.9 (Low). CVSS vector: AV:L/AC:M/Au:N/C:P/I:N/A:N. EPSS exploitation probability: 0.1%.

Infosphere Information Server CVE-2012-4832

LOW

Information Exposure (CWE-200)

2013-01-31 psirt@us.ibm.com

Information Disclosure IBM Infosphere Information Server Infosphere Business Glossary

1.9

CVSS 2.0 · NVD

Severity by source

NVD PRIMARY

1.9 LOW

AV:L/AC:M/Au:N/C:P/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Local

Attack Complexity

Confidentiality

Integrity

None

Availability

None

Lifecycle Timeline

CVE Published

Jan 31, 2013 - 12:06 cve.org

LOW 1.9

DescriptionCVE.org

Information Services Framework (ISF) in IBM InfoSphere Information Server 8.1, 8.5 before FP3, and 8.7 and InfoSphere Business Glossary 8.1.1 and 8.1.2 does not have an off autocomplete attribute for the password field on the login page, which makes it easier for remote attackers to obtain access by leveraging an unattended workstation.

AnalysisAI

Information Services Framework (ISF) in IBM InfoSphere Information Server 8.1, 8.5 before FP3, and 8.7 and InfoSphere Business Glossary 8.1.1 and 8.1.2 does not have an off autocomplete attribute for. Rated low severity (CVSS 1.9). No vendor patch available.

Technical ContextAI

This vulnerability is classified as Exposure of Sensitive Information (CWE-200), which allows attackers to access sensitive data that should not be disclosed. Information Services Framework (ISF) in IBM InfoSphere Information Server 8.1, 8.5 before FP3, and 8.7 and InfoSphere Business Glossary 8.1.1 and 8.1.2 does not have an off autocomplete attribute for the password field on the login page, which makes it easier for remote attackers to obtain access by leveraging an unattended workstation. Affected products include: Ibm Infosphere Business Glossary, Ibm Infosphere Information Server.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Minimize information in error messages, implement proper access controls, encrypt sensitive data at rest and in transit.