Medium severity · published Feb 1, 2017
CVE-2016-3022
IBM Security Access Manager for Web could allow an authenticated user to gain access to highly sensitive information due to incorrect file permissions
6.5
CVSS
1.7%
EPSS
No
On KEV
Description
IBM Security Access Manager for Web could allow an authenticated user to gain access to highly sensitive information due to incorrect file permissions.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.7% · higher than 77% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SA
Security Access Manager 9.0 Firmware · Ibm
9.0.0; 9.0.0.1; 9.0.1.0 · source: NVD
SA
Security Access Manager For Mobile 8.0 Firmware · Ibm
8.0.0.1; 8.0.0.2; 8.0.0.3; 8.0.0.5; 8.0.1.0; 8.0.1.2; +2 more · source: NVD
SA
Security Access Manager For Web 7.0 Firmware · Ibm
7.0.0.1; 7.0.0.2; 7.0.0.3; 7.0.0.4; 7.0.0.5; 7.0.0.6; +10 more · source: NVD
SA
Security Access Manager For Web 8.0 Firmware · Ibm
8.0.0.1; 8.0.0.2; 8.0.0.3; 8.0.0.5; 8.0.1.0; 8.0.1.2; +2 more · source: NVD
Affected product
SA
Security Access Manager 9.0 Firmware
Ibm
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2016-3022
CVE.org
https://www.cve.org/CVERecord?id=CVE-2016-3022
Patch
http://www.ibm.com/support/docview.wss?uid=swg21995360
Third Party Advisory
http://www.securityfocus.com/bid/96130
More from Security Access Manager 9.0 Firmware
9.1
CVE-2016-2908
IBM Single Sign On for Bluemix could allow a remote attacker to obtain sensitive information, caused by a XML external entity (XXE) error when processing XML data by the XML…
8.8
CVE-2017-1453
IBM Security Access Manager Appliance 9.0.3 could allow a remote authenticated attacker to execute arbitrary commands on the system
8.8
CVE-2016-3029
IBM Security Access Manager for Web is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user…
8.1
CVE-2017-1477
IBM Security Access Manager Appliance 9.0.3 is vulnerable to a XML External Entity Injection (XXE) attack when processing XML data
8.0
CVE-2015-5018
IBM Security Access Manager for Web 7.0.0 before FP19 and 8.0 before 8.0.1.3 IF3, and Security Access Manager 9.0 before 9.0.0.0 IF1, allows remote authenticated users to execute…