CVE-2016-3024: IBM Security Access Manager for Web allows web pages to be stored locally which can be read by another user on the system

Medium severity · published Feb 1, 2017

CVE-2016-3024

IBM Security Access Manager for Web allows web pages to be stored locally which can be read by another user on the system

4.0

CVSS

0.3%

EPSS

On KEV

Description

IBM Security Access Manager for Web allows web pages to be stored locally which can be read by another user on the system.

CVSS vector

CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Attack vector

Local

Complexity

Low

Privileges

None

User interaction

None

Confidentiality

Low

Integrity

None

Availability

None

Scope

Unchanged

Exploitation

Is it being used?

Exploit prediction (EPSS)0.3% · higher than 25% of CVEs

Exploited in the wildNo evidence yet

CISA KEVNot listed

Ransomware campaign useNot known

Affected products

Which versions

Security Access Manager 9.0 Firmware · Ibm

9.0.0; 9.0.0.1; 9.0.1.0 · source: NVD

Security Access Manager For Mobile 8.0 Firmware · Ibm

8.0.0.1; 8.0.0.2; 8.0.0.3; 8.0.0.5; 8.0.1.0; 8.0.1.2; +2 more · source: NVD

Security Access Manager For Web 8.0 Firmware · Ibm

8.0.0.1; 8.0.0.2; 8.0.0.3; 8.0.0.5; 8.0.1.0; 8.0.1.2; +2 more · source: NVD

Affected product

Security Access Manager 9.0 Firmware

Ibm

All Security Access Manager 9.0 Firmware CVEs

References

NVD

https://nvd.nist.gov/vuln/detail/CVE-2016-3024

CVE.org

https://www.cve.org/CVERecord?id=CVE-2016-3024

Patch

http://www.ibm.com/support/docview.wss?uid=swg21995340

www.securityfocus.com

http://www.securityfocus.com/bid/96132

More from Security Access Manager 9.0 Firmware

9.1

CVE-2016-2908

IBM Single Sign On for Bluemix could allow a remote attacker to obtain sensitive information, caused by a XML external entity (XXE) error when processing XML data by the XML…

8.8

CVE-2017-1453

IBM Security Access Manager Appliance 9.0.3 could allow a remote authenticated attacker to execute arbitrary commands on the system

8.8

CVE-2016-3029

IBM Security Access Manager for Web is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user…

8.1

CVE-2017-1477

IBM Security Access Manager Appliance 9.0.3 is vulnerable to a XML External Entity Injection (XXE) attack when processing XML data

8.0

CVE-2015-5018

IBM Security Access Manager for Web 7.0.0 before FP19 and 8.0 before 8.0.1.3 IF3, and Security Access Manager 9.0 before 9.0.0.0 IF1, allows remote authenticated users to execute…