High severity · published Feb 16, 2017
CVE-2016-5919
IBM Security Access Manager for Web 7.0.0, 8.0.0, and 9.0.0 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information
7.5
CVSS
0.7%
EPSS
No
On KEV
Description
IBM Security Access Manager for Web 7.0.0, 8.0.0, and 9.0.0 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM Reference #: 1996868.
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.7% · higher than 52% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SA
Security Access Manager 9.0 Firmware · Ibm
All versions, or not specified · source: NVD
SA
Security Access Manager For Mobile · Ibm
All versions, or not specified · source: NVD
SA
Security Access Manager For Web 7.0 Firmware · Ibm
All versions, or not specified · source: NVD
SA
Security Access Manager For Web 8.0 Firmware · Ibm
All versions, or not specified · source: NVD
Affected product
SA
Security Access Manager 9.0 Firmware
Ibm
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2016-5919
CVE.org
https://www.cve.org/CVERecord?id=CVE-2016-5919
Patch
http://www.ibm.com/support/docview.wss?uid=swg21996868
www.securitytracker.com
http://www.securitytracker.com/id/1037855
More from Security Access Manager 9.0 Firmware
9.1
CVE-2016-2908
IBM Single Sign On for Bluemix could allow a remote attacker to obtain sensitive information, caused by a XML external entity (XXE) error when processing XML data by the XML…
8.8
CVE-2017-1453
IBM Security Access Manager Appliance 9.0.3 could allow a remote authenticated attacker to execute arbitrary commands on the system
8.8
CVE-2016-3029
IBM Security Access Manager for Web is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user…
8.1
CVE-2017-1477
IBM Security Access Manager Appliance 9.0.3 is vulnerable to a XML External Entity Injection (XXE) attack when processing XML data
8.0
CVE-2015-5018
IBM Security Access Manager for Web 7.0.0 before FP19 and 8.0 before 8.0.1.3 IF3, and Security Access Manager 9.0 before 9.0.0.0 IF1, allows remote authenticated users to execute…