What is the CVSS score of CVE-2013-4024?

CVE-2013-4024 has a CVSS 2.0 base score of 4.3 (Medium). CVSS vector: AV:N/AC:M/Au:N/C:P/I:N/A:N. EPSS exploitation probability: 0.2%.

Data Studio Web Console CVE-2013-4024

MEDIUM

Information Exposure (CWE-200)

2013-09-25 psirt@us.ibm.com

Information Disclosure IBM Data Studio Web Console Db2 Recovery Expert Infosphere Optim Configuration Manager Optim Performance Manager

4.3

CVSS 2.0 · NVD

Severity by source

NVD PRIMARY

4.3 MEDIUM

AV:N/AC:M/Au:N/C:P/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

AV:N/AC:M/Au:N/C:P/I:N/A:N

Attack Vector

Network

Attack Complexity

Confidentiality

Integrity

None

Availability

None

Lifecycle Timeline

CVE Published

Sep 25, 2013 - 10:31 cve.org

MEDIUM 4.3

DescriptionCVE.org

IBM Data Studio Web Console 3.x before 3.2, Optim Performance Manager 5.x before 5.2, InfoSphere Optim Configuration Manager 2.x before 2.2, and DB2 Recovery Expert 2.x support HTTP access to the Web Console, which allows remote attackers to read session cookies by sniffing the network.

AnalysisAI

IBM Data Studio Web Console 3.x before 3.2, Optim Performance Manager 5.x before 5.2, InfoSphere Optim Configuration Manager 2.x before 2.2, and DB2 Recovery Expert 2.x support HTTP access to the Web. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable. No vendor patch available.

Technical ContextAI

This vulnerability is classified as Exposure of Sensitive Information (CWE-200), which allows attackers to access sensitive data that should not be disclosed. IBM Data Studio Web Console 3.x before 3.2, Optim Performance Manager 5.x before 5.2, InfoSphere Optim Configuration Manager 2.x before 2.2, and DB2 Recovery Expert 2.x support HTTP access to the Web Console, which allows remote attackers to read session cookies by sniffing the network. Affected products include: Ibm Data Studio Web Console, Ibm Db2 Recovery Expert, Ibm Infosphere Optim Configuration Manager, Ibm Optim Performance Manager. Version information: before 3.2.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Minimize information in error messages, implement proper access controls, encrypt sensitive data at rest and in transit.