Skip to main content

Security Appscan CVE-2014-4806

MEDIUM
Insufficiently Protected Credentials (CWE-522)
2014-08-29 psirt@us.ibm.com
IBM Information Disclosure Security Appscan
5.5
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
None
Availability
None

Lifecycle Timeline

1
CVE Published
Aug 29, 2014 - 09:55 cve.org
MEDIUM 5.5

DescriptionCVE.org

The installation process in IBM Security AppScan Enterprise 8.x before 8.6.0.2 iFix 003, 8.7.x before 8.7.0.1 iFix 003, 8.8.x before 8.8.0.1 iFix 002, and 9.0.x before 9.0.0.1 iFix 001 on Linux places a cleartext password in a temporary file, which allows local users to obtain sensitive information by reading this file.

AnalysisAI

The installation process in IBM Security AppScan Enterprise 8.x before 8.6.0.2 iFix 003, 8.7.x before 8.7.0.1 iFix 003, 8.8.x before 8.8.0.1 iFix 002, and 9.0.x before 9.0.0.1 iFix 001 on Linux. Rated medium severity (CVSS 5.5), this vulnerability is low attack complexity. No vendor patch available.

Technical ContextAI

This vulnerability is classified as Insufficiently Protected Credentials (CWE-522), which allows attackers to obtain user credentials due to weak protection mechanisms. The installation process in IBM Security AppScan Enterprise 8.x before 8.6.0.2 iFix 003, 8.7.x before 8.7.0.1 iFix 003, 8.8.x before 8.8.0.1 iFix 002, and 9.0.x before 9.0.0.1 iFix 001 on Linux places a cleartext password in a temporary file, which allows local users to obtain sensitive information by reading this file. Affected products include: Ibm Security Appscan. Version information: before 8.6.0.2.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Hash passwords with strong algorithms (bcrypt, argon2), encrypt credentials in transit and at rest, never log credentials.

More in Security Appscan

View all
CVE-2014-6119 CRITICAL
9.3 Dec 23

IBM Security AppScan Enterprise 8.5 before 8.5 IFix 002, 8.6 before 8.6 IFix 004, 8.7 before 8.7 IFix 004, 8.8 before 8.
CVE-2014-0904 HIGH
7.6 Mar 26

The update process in IBM Security AppScan Standard 7.9 through 8.8 does not require integrity checks of downloaded file
CVE-2016-9981 HIGH
8.1 Aug 02

IBM AppScan Enterprise Edition 9.0 contains an unspecified vulnerability that could allow an attacker to hijack a valid

CVE-2016-6042 HIGH
7.3 Feb 01

IBM AppScan Enterprise Edition could allow a remote attacker to execute arbitrary code on the system, caused by improper
CVE-2013-0513 HIGH
7.2 Mar 29

IBM Security AppScan Enterprise 5.6 and 8.x before 8.7 and IBM Rational Policy Tester 5.6 and 8.x before 8.5.0.4 create

CVE-2013-0532 MEDIUM
6.8 Mar 29

Cross-site request forgery (CSRF) vulnerability in IBM Security AppScan Enterprise 5.6 and 8.x before 8.7 and IBM Ration
CVE-2016-0288 MEDIUM
6.5 Jun 01

IBM Security AppScan Standard 8.7.x, 8.8.x, and 9.x before 9.0.3.2 and Security AppScan Enterprise allow remote authenti
CVE-2013-0511 MEDIUM
6.5 Mar 29

Multiple SQL injection vulnerabilities in IBM Security AppScan Enterprise 5.6 and 8.x before 8.7 allow remote authentica
CVE-2012-0741 MEDIUM
5.8 Dec 28

IBM Security AppScan Enterprise before 8.6.0.2 and Rational Policy Tester before 8.5.0.3 do not validate X.509 certifica
CVE-2012-0738 MEDIUM
5.8 Dec 28

IBM Security AppScan Enterprise before 8.6.0.2 and Rational Policy Tester before 8.5.0.3 do not validate X.509 certifica
CVE-2014-8918 MEDIUM
5.8 Feb 02

IBM Security AppScan Standard 8.x and 9.x before 9.0.1.1 FP1 does not properly verify X.509 certificates from SSL server
CVE-2014-6122 MEDIUM
5.5 Dec 23

IBM Security AppScan Enterprise 8.5 before 8.5 IFix 002, 8.6 before 8.6 IFix 004, 8.7 before 8.7 IFix 004, 8.8 before 8.

Same weakness CWE-522 – Insufficiently Protected Credentials

View all
CVE-2017-9248 CRITICAL POC
9.8
CVE-2024-44000 CRITICAL POC
9.8
CVE-2023-6421 HIGH POC
7.5
CVE-2017-8225 CRITICAL POC
9.8
CVE-2025-25570 CRITICAL POC
9.8
CVE-2017-17106 CRITICAL POC
9.8
CVE-2017-8837 CRITICAL POC
9.8
CVE-2017-3192 CRITICAL
9.8

Same technique Information Disclosure

View all
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8
CVE-2023-7028 CRITICAL POC
10.0
CVE-2017-0213 HIGH POC
7.3

Share

CVE-2014-4806 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy