vulnwire
5.3med

CVE-2017-1143

IBM Kenexa LCMS Premier on Cloud 9.x and 10.0 could allow a remote attacker to obtain sensitive information, caused by the failure to prope…

Published 9 y ago · modified 4 mo ago · JSON

CVSS
5.3
v3.0 · NVD
CISA KEV
No
not known exploited
EPSS
0.9%
percentile 60%
Public exploits
0
none known

IBM Kenexa LCMS Premier on Cloud 9.x and 10.0 could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable HTTP Strict Transport Security. An attacker could exploit this vulnerability to obtain sensitive information using man in the middle techniques. IBM Reference #: 1998874.

Exploit prediction (EPSS)

0.92% probability of exploitation in the next 30 days, higher than 60% of all scored CVEs.

CVSS scores

Assigned byVersionScoreVector
NVD3.05.3CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N
NVD2.03.5AV:N/AC:M/Au:S/C:P/I:N/A:N

Affected products

  • IBM Corporation Kenexa LCMS Premier on Cloud

Classification

Weakness
  • CWE-200 Exposure of Sensitive Information to an Unauthorized Actor

References

  • ibm.com /support/docview.wss?uid=swg21998874 · x_refsource_CONFIRM, x_transferred
  • securityfocus.com /bid/97079 · vdb-entry, x_refsource_BID, x_transferred

Sources

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.