Skip to main content

Security Identity Manager CVE-2016-9739

HIGH
Credentials Management Errors (CWE-255)
2017-02-01 psirt@us.ibm.com
7.8
CVSS 3.0 · NVD
Share

Severity by source

NVD PRIMARY
7.8 HIGH
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

1
CVE Published
Feb 01, 2017 - 22:59 cve.org
HIGH 7.8

DescriptionCVE.org

IBM Security Identity Manager Virtual Appliance stores user credentials in plain in clear text which can be read by a local user.

AnalysisAI

IBM Security Identity Manager Virtual Appliance stores user credentials in plain in clear text which can be read by a local user. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity.

Technical ContextAI

This vulnerability is classified under CWE-255. IBM Security Identity Manager Virtual Appliance stores user credentials in plain in clear text which can be read by a local user. Affected products include: Ibm Security Identity Manager.

RemediationAI

A vendor patch is available. Apply the latest security update as soon as possible. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.

CVE-2017-1407 HIGH
8.8 Sep 28

IBM Security Identity Manager Virtual Appliance 6.0 and 7.0 could allow a remote authenticated attacker to execute arbit

CVE-2014-6106 HIGH
8.8 Sep 18

Cross-site request forgery (CSRF) vulnerability in IBM Security Identity Manager 5.1, 6.0, and 7.0 allows remote attacke

CVE-2021-29686 HIGH
8.8 May 20

IBM Security Identity Manager 7.0.2 could allow an authenticated user to bypass security and perform actions that they s

CVE-2019-4561 HIGH
8.8 Nov 20

IBM Security Identity Manager 6.0.0 could allow a remote attacker to execute arbitrary code on the system, caused by the

CVE-2018-1453 HIGH
8.8 Jun 08

IBM Security Identity Manager Virtual Appliance 7.0 allows an authenticated attacker to upload or transfer files of dang

CVE-2017-1483 HIGH
8.6 Sep 28

IBM Security Identity Manager Adapters 6.0 and 7.0 does not perform an authentication check for a critical resource or f

CVE-2017-1362 HIGH
7.8 Sep 25

IBM Security Identity Manager Adapters 6.0 and 7.0 stores user credentials in plain in clear text which can be read by a

CVE-2021-29691 HIGH
7.5 May 20

IBM Security Identity Manager 7.0.2 contains hard-coded credentials, such as a password or cryptographic key, which it u

CVE-2021-29688 HIGH
7.5 May 20

IBM Security Identity Manager 7.0.2 could allow a remote attacker to obtain sensitive information when a detailed techni

CVE-2021-20488 MEDIUM
6.5 Jun 16

IBM Security Identity Manager 6.0.2 could allow an authenticated malicious user to change the passwords of other users i

CVE-2021-20483 MEDIUM
6.5 Jun 16

IBM Security Identity Manager 6.0.2 is vulnerable to server-side request forgery (SSRF). Rated medium severity (CVSS 6.5

CVE-2021-29683 MEDIUM
6.5 May 20

IBM Security Identity Manager 7.0.2 stores user credentials in plain clear text which can be read by an authenticated us

Share

CVE-2016-9739 vulnerability details – vuln.today

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy