Low severity · published Feb 1, 2017
CVE-2016-9703
IBM Security Identity Manager Virtual Appliance does not invalidate session tokens which could allow an unauthorized user with physical access to the work station to obtain…
2.4
CVSS
0.3%
EPSS
No
On KEV
Description
IBM Security Identity Manager Virtual Appliance does not invalidate session tokens which could allow an unauthorized user with physical access to the work station to obtain sensitive information.
CVSS vector
CVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Attack vector
Physical
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
Low
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 28% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SI
Security Identity Manager Virtual Appliance · Ibm
7.0.0.0; 7.0.0.1; 7.0.0.2; 7.0.0.3; 7.0.1.0; 7.0.1.1; +3 more · source: NVD
Affected product
SI
Security Identity Manager Virtual Appliance
Ibm
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2016-9703
CVE.org
https://www.cve.org/CVERecord?id=CVE-2016-9703
Patch
http://www.ibm.com/support/docview.wss?uid=swg21996761
Third Party Advisory
http://www.securityfocus.com/bid/95327
www.securitytracker.com
http://www.securitytracker.com/id/1037765
More from Security Identity Manager Virtual Appliance
9.8
CVE-2016-0332
IBM Security Identity Manager (ISIM) Virtual Appliance 7.0.0.0 through 7.0.1.0 before 7.0.1-ISS-SIM-FP0001 do not properly restrict failed login attempts, which makes it easier…
8.8
CVE-2016-0324
IBM Security Identity Manager (ISIM) Virtual Appliance 7.0.0.0 through 7.0.1.0 before 7.0.1-ISS-SIM-FP0001 allows remote authenticated users to execute arbitrary code with…
7.8
CVE-2019-4676
IBM Security Identity Manager Virtual Appliance 7.0.2 stores user credentials in plain in clear text which can be read by a local user
7.8
CVE-2016-0327
IBM Security Identity Manager (ISIM) Virtual Appliance 7.0.0.0 through 7.0.1.0 before 7.0.1-ISS-SIM-FP0001 allows local users to gain administrator privileges via unspecified…
6.1
CVE-2016-9704
IBM Security Identity Manager Virtual Appliance is vulnerable to cross-site scripting