Medium severity · published Feb 1, 2017
CVE-2016-3043
IBM Security Access Manager for Web could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable HTTP Strict Transport Security
5.9
CVSS
1.2%
EPSS
No
On KEV
Description
IBM Security Access Manager for Web could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable HTTP Strict Transport Security. An attacker could exploit this vulnerability to obtain sensitive information using man in the middle techniques.
CVSS vector
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
High
Privileges
None
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.2% · higher than 69% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SA
Security Access Manager 9.0 Firmware · Ibm
All versions, or not specified · source: NVD
SA
Security Access Manager For Mobile · Ibm
All versions, or not specified · source: NVD
SA
Security Access Manager For Web 7.0 Firmware · Ibm
All versions, or not specified · source: NVD
SA
Security Access Manager For Web 8.0 Firmware · Ibm
All versions, or not specified · source: NVD
Affected product
SA
Security Access Manager 9.0 Firmware
Ibm
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2016-3043
CVE.org
https://www.cve.org/CVERecord?id=CVE-2016-3043
Patch
http://www.ibm.com/support/docview.wss?uid=swg21995446
Third Party Advisory
http://www.securityfocus.com/bid/95107
More from Security Access Manager 9.0 Firmware
9.1
CVE-2016-2908
IBM Single Sign On for Bluemix could allow a remote attacker to obtain sensitive information, caused by a XML external entity (XXE) error when processing XML data by the XML…
8.8
CVE-2017-1453
IBM Security Access Manager Appliance 9.0.3 could allow a remote authenticated attacker to execute arbitrary commands on the system
8.8
CVE-2016-3029
IBM Security Access Manager for Web is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user…
8.1
CVE-2017-1477
IBM Security Access Manager Appliance 9.0.3 is vulnerable to a XML External Entity Injection (XXE) attack when processing XML data
8.0
CVE-2015-5018
IBM Security Access Manager for Web 7.0.0 before FP19 and 8.0 before 8.0.1.3 IF3, and Security Access Manager 9.0 before 9.0.0.0 IF1, allows remote authenticated users to execute…