vulnwire
9.1crit

CVE-2016-3028

IBM Security Access Manager for Web 7.0 before IF2 and 8.0 before 8.0.1.4 IF3 and Security Access Manager 9.0 before 9.0.1.0 IF5 allow remo…

Published 9 y ago · modified 4 mo ago · JSON

CVSS
9.1
v3.0 · NVD
CISA KEV
No
not known exploited
EPSS
3.5%
percentile 89%
Public exploits
0
none known

IBM Security Access Manager for Web 7.0 before IF2 and 8.0 before 8.0.1.4 IF3 and Security Access Manager 9.0 before 9.0.1.0 IF5 allow remote authenticated users to execute arbitrary commands by leveraging LMI admin access.

Exploit prediction (EPSS)

3.54% probability of exploitation in the next 30 days, higher than 89% of all scored CVEs.

CVSS scores

Assigned byVersionScoreVector
NVD3.09.1CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
NVD2.09.0AV:N/AC:L/Au:S/C:C/I:C/A:C

Classification

Weakness
  • CWE-78 Improper Neutralization of Special Elements used in an OS Command

References

  • www-01.ibm.com /support/docview.wss?uid=swg1IV89257 · vendor-advisory, x_refsource_AIXAPAR, x_transferred
  • www-01.ibm.com /support/docview.wss?uid=swg21990317 · x_refsource_CONFIRM, x_transferred
  • securityfocus.com /bid/93176 · vdb-entry, x_refsource_BID, x_transferred
  • www-01.ibm.com /support/docview.wss?uid=swg1IV89322 · vendor-advisory, x_refsource_AIXAPAR, x_transferred
  • www-01.ibm.com /support/docview.wss?uid=swg1IV89326 · vendor-advisory, x_refsource_AIXAPAR, x_transferred

Sources

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.