CVE-2017-1476

CWE-200 — Information Exposure3 documents3 sources
Severity
5.9MEDIUM
EPSS
0.2%
top 53.14%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
IBM Security Access ManagerIBM Security Access Manager FOR MobileIBM Security Access Manager FOR WEB
Timeline
PublishedJun 6
Latest updateMay 13

Description

IBM Security Access Manager Appliance 7.0.0, 8.0.0 through 8.0.1.6, and 9.0.0 through 9.0.3.1 could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable HTTP Strict Transport Security. An attacker could exploit this vulnerability to obtain sensitive information using man in the middle techniques. IBM X-Force ID: 128610.

CVSS vector

CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:NExploitability: 2.2 | Impact: 3.6

Affected Packages2 packages

▶NVDibm/security_access_manager9.0.0 — 9.0.3.1+2
▶CVEListV5ibm/security_access_manager20 versions+19

Patches

Patch: www.ibm.com ↗Patch: www.ibm.com ↗

🔴Vulnerability Details

2
GHSA
GHSA-gv2f-c27v-pchr: IBM Security Access Manager Appliance 7↗2022-05-13
▶
CVEList
CVE-2017-1476: IBM Security Access Manager Appliance 7↗2018-06-06
▶
CVE-2017-1476 (MEDIUM CVSS 5.9) | IBM Security Access Manager Applian | cvebase.io