What is the CVSS score of CVE-2014-6176?

CVE-2014-6176 has a CVSS 2.0 base score of 4.3 (Medium). CVSS vector: AV:N/AC:M/Au:N/C:P/I:N/A:N. EPSS exploitation probability: 0.4%.

Websphere Process Server CVE-2014-6176

MEDIUM

Cryptographic Issues (CWE-310)

2014-12-16 psirt@us.ibm.com

Information Disclosure IBM Websphere Process Server Business Process Manager Websphere Enterprise Service Bus

4.3

CVSS 2.0 · NVD

Severity by source

NVD PRIMARY

4.3 MEDIUM

AV:N/AC:M/Au:N/C:P/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Confidentiality

Integrity

None

Availability

None

Lifecycle Timeline

CVE Published

Dec 16, 2014 - 23:59 cve.org

MEDIUM 4.3

DescriptionCVE.org

IBM WebSphere Process Server 7.0, WebSphere Enterprise Service Bus 7.0, and Business Process Manager Advanced 7.5.x through 7.5.1.2, 8.0.x through 8.0.1.3, and 8.5.x through 8.5.5 disregard the SSL setting in the SCA module HTTP import binding and unconditionally select the SSLv3 protocol, which makes it easier for remote attackers to hijack sessions or obtain sensitive information by leveraging the use of a weak cipher.

AnalysisAI

IBM WebSphere Process Server 7.0, WebSphere Enterprise Service Bus 7.0, and Business Process Manager Advanced 7.5.x through 7.5.1.2, 8.0.x through 8.0.1.3, and 8.5.x through 8.5.5 disregard the SSL. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable. No vendor patch available.

Technical ContextAI

This vulnerability is classified under CWE-310. IBM WebSphere Process Server 7.0, WebSphere Enterprise Service Bus 7.0, and Business Process Manager Advanced 7.5.x through 7.5.1.2, 8.0.x through 8.0.1.3, and 8.5.x through 8.5.5 disregard the SSL setting in the SCA module HTTP import binding and unconditionally select the SSLv3 protocol, which makes it easier for remote attackers to hijack sessions or obtain sensitive information by leveraging the use of a weak cipher. Affected products include: Ibm Business Process Manager, Ibm Websphere Enterprise Service Bus, Ibm Websphere Process Server. Version information: through 7.5.1.2.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.