7.5high
CVE-2016-5958
IBM Security Privileged Identity Manager could allow a remote attacker to obtain sensitive information, caused by the failure to set the se…
Published 9 y ago · modified 4 mo ago · JSON
CVSS
7.5
v3.0 · NVD
CISA KEV
No
not known exploited
EPSS
1.7%
percentile 77%
Public exploits
0
none known
Summary
IBM Security Privileged Identity Manager could allow a remote attacker to obtain sensitive information, caused by the failure to set the secure flag for the session cookie in SSL mode. By intercepting its transmission within an HTTP session, an attacker could exploit this vulnerability to capture the cookie and obtain sensitive information.
Exploit prediction (EPSS)
1.69% probability of exploitation in the next 30 days, higher than 77% of all scored CVEs.
CVSS scores
| Assigned by | Version | Score | Vector |
|---|---|---|---|
| NVD | 3.0 | 7.5 | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
| NVD | 2.0 | 5.0 | AV:N/AC:L/Au:N/C:P/I:N/A:N |
Affected products
- IBM Corporation Privileged Identity Manager
Classification
- Weakness
- CWE-200 Exposure of Sensitive Information to an Unauthorized Actor
References
- ibm.com /support/docview.wss?uid=swg21996614 · x_refsource_CONFIRM, x_transferred
- securityfocus.com /bid/95196 · vdb-entry, x_refsource_BID, x_transferred
Sources
- CVE List: CVE-2016-5958
- NVD: CVE-2016-5958
vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.