High severity · published Jan 26, 2018
CVE-2016-2983
IBM Tealeaf Customer Experience 8.7, 8.8, and 9.0.2 could allow a remote attacker under unusual circumstances to read operational data or TLS session state for any active…
8.1
CVSS
1.7%
EPSS
No
On KEV
Description
IBM Tealeaf Customer Experience 8.7, 8.8, and 9.0.2 could allow a remote attacker under unusual circumstances to read operational data or TLS session state for any active sessions, cause denial of service, or bypass security. IBM X-Force ID: 113999.
CVSS vector
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
High
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.7% · higher than 77% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
TC
Tealeaf Customer Experience · Ibm
8.7; 8.8; 9.0.2 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2016-2983
CVE.org
https://www.cve.org/CVERecord?id=CVE-2016-2983
Patch
http://www.ibm.com/support/docview.wss?uid=swg22006393
Patch
http://www.ibm.com/support/docview.wss?uid=swg22006455
Third Party Advisory
http://www.securityfocus.com/bid/102891
Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/113999
More from Tealeaf Customer Experience
9.8
CVE-2017-1204
IBM Tealeaf Customer Experience 8.7, 8.8, and 9.0.2 contains hard-coded credentials
8.6
CVE-2015-4988
Directory traversal vulnerability in the replay server in IBM Tealeaf Customer Experience before 8.7.1.8818, 8.8 before 8.8.0.9026, 9.0.0, 9.0.0A, 9.0.1 before 9.0.1.1083, 9.0.1A…
7.5
CVE-2016-5996
The web portal in IBM Tealeaf Customer Experience before 8.7.1.8847 FP10, 8.8 before 8.8.0.9049 FP9, 9.0.0 and 9.0.1 before 9.0.1.1117 FP5, 9.0.1A before 9.0.1.5108_9.0.1A FP5,…
6.8
CVE-2016-5977
Open redirect vulnerability in the web portal in IBM Tealeaf Customer Experience before 8.7.1.8847 FP10, 8.8 before 8.8.0.9049 FP9, 9.0.0 and 9.0.1 before 9.0.1.1117 FP5, 9.0.1A…
6.5
CVE-2015-4987
The search and replay servers in IBM Tealeaf Customer Experience 8.0 through 9.0.2 allow remote attackers to bypass authentication via unspecified vectors