2.4low
CVE-2016-9703
IBM Security Identity Manager Virtual Appliance does not invalidate session tokens which could allow an unauthorized user with physical acc…
Published 9 y ago · modified 4 mo ago · JSON
CVSS
2.4
v3.0 · NVD
CISA KEV
No
not known exploited
EPSS
0.3%
percentile 28%
Public exploits
0
none known
Summary
IBM Security Identity Manager Virtual Appliance does not invalidate session tokens which could allow an unauthorized user with physical access to the work station to obtain sensitive information.
Exploit prediction (EPSS)
0.35% probability of exploitation in the next 30 days, higher than 28% of all scored CVEs.
CVSS scores
| Assigned by | Version | Score | Vector |
|---|---|---|---|
| NVD | 3.0 | 2.4 | CVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N |
| NVD | 2.0 | 2.1 | AV:L/AC:L/Au:N/C:P/I:N/A:N |
Affected products
- IBM Corporation Identity Manager
Classification
- Weakness
- CWE-384 Session Fixation
References
- securityfocus.com /bid/95327 · vdb-entry, x_refsource_BID, x_transferred
- securitytracker.com /id/1037765 · vdb-entry, x_refsource_SECTRACK, x_transferred
- ibm.com /support/docview.wss?uid=swg21996761 · x_refsource_CONFIRM, x_transferred
Sources
- CVE List: CVE-2016-9703
- NVD: CVE-2016-9703
vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.