Medium severity · published Aug 6, 2018
CVE-2017-1409
IBM Security Identity Governance Virtual Appliance 5.2 through 5.2.3.2 discloses sensitive information to unauthorized users
5.3
CVSS
1.3%
EPSS
No
On KEV
Description
IBM Security Identity Governance Virtual Appliance 5.2 through 5.2.3.2 discloses sensitive information to unauthorized users. The information can be used to mount further attacks on the system. IBM X-Force ID: 127396.
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
Low
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.3% · higher than 70% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SI
Security Identity Governance and Intelligence · IBM
5.2; 5.2.1; 5.2.2; 5.2.2.1; 5.2.3; 5.2.3.1; +1 more · source: vendor, NVD
Affected product
SI
Security Identity Governance and Intelligence
IBM
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2017-1409
CVE.org
https://www.cve.org/CVERecord?id=CVE-2017-1409
Patch
http://www.ibm.com/support/docview.wss?uid=swg22016869
VDB Entry
https://exchange.xforce.ibmcloud.com/vulnerabilities/127396
More from Security Identity Governance and Intelligence
9.8
CVE-2020-4958
IBM Security Identity Governance and Intelligence 5.2.6 does not perform any authentication for functionality that requires a provable user identity or consumes a significant…
9.8
CVE-2018-1944
IBM Security Identity Governance and Intelligence 5.2 through 5.2.4.1 Virtual Appliance contains hard-coded credentials, such as a password or cryptographic key, which it uses for…
8.8
CVE-2017-1407
IBM Security Identity Manager Virtual Appliance 6.0 and 7.0 could allow a remote authenticated attacker to execute arbitrary commands on the system
8.6
CVE-2017-1483
IBM Security Identity Manager Adapters 6.0 and 7.0 does not perform an authentication check for a critical resource or functionality allowing anonymous users access to protected…
8.2
CVE-2020-4795
IBM Security Identity Governance and Intelligence 5.2.6 could disclose sensitive information to an unauthorized user using a specially crafted HTTP request