Medium severity · published Feb 1, 2017
CVE-2016-3035
IBM AppScan Source could reveal some sensitive information through the browsing of testlinks on the server
5.3
CVSS
1%
EPSS
No
On KEV
Description
IBM AppScan Source could reveal some sensitive information through the browsing of testlinks on the server.
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
Low
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.0% · higher than 64% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SA
Security Appscan Source · Ibm
9.0.1; 9.0.2; 9.0.3 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2016-3035
CVE.org
https://www.cve.org/CVERecord?id=CVE-2016-3035
Patch
http://www.ibm.com/support/docview.wss?uid=swg21987325
Third Party Advisory
http://www.securityfocus.com/bid/95177
More from Security Appscan Source
9.8
CVE-2014-6120
IBM Rational AppScan Source 8.0 through 8.0.0.2 and 8.5 through 8.5.0.1 and Security AppScan Source 8.6 through 8.6.0.2, 8.7 through 8.7.0.1, 8.8, 9.0 through 9.0.0.1, and 9.0.1…
4.4
CVE-2016-3034
IBM AppScan Source uses a one-way hash without salt to encrypt highly sensitive information, which could allow a local attacker to decrypt information more easily
–
CVE-2014-6123
IBM Rational AppScan Source 8.0 through 8.0.0.2 and 8.5 through 8.5.0.1 and Security AppScan Source 8.6 through 8.6.0.2, 8.7 through 8.7.0.1, 8.8, 9.0 through 9.0.0.1, and 9.0.1…
–
CVE-2014-6135
IBM Security AppScan Enterprise 8.5 before 8.5 IFix 002, 8.6 before 8.6 IFix 004, 8.7 before 8.7 IFix 004, 8.8 before 8.8 iFix 003, 9.0 before 9.0.0.1 iFix 003, and 9.0.1 before…
–
CVE-2014-6122
IBM Security AppScan Enterprise 8.5 before 8.5 IFix 002, 8.6 before 8.6 IFix 004, 8.7 before 8.7 IFix 004, 8.8 before 8.8 iFix 003, 9.0 before 9.0.0.1 iFix 003, and 9.0.1 before…