Critical severity · published May 2, 2018
CVE-2017-1601
IBM Security Guardium 10.0, 10.0.1, and 10.1 through 10.1.4 Database Activity Monitor does not require that users should have strong passwords by default, which makes it easier…
9.8
CVSS
2.4%
EPSS
No
On KEV
Description
IBM Security Guardium 10.0, 10.0.1, and 10.1 through 10.1.4 Database Activity Monitor does not require that users should have strong passwords by default, which makes it easier for attackers to compromise user accounts. IBM X-Force ID: 132624.
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)2.4% · higher than 84% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SG
Security Guardium Database Activity Monitor · Ibm
10.0; 10.0.1; 10.1; 10.1.2; 10.1.3; 10.1.4 · source: NVD
Affected product
SG
Security Guardium Database Activity Monitor
Ibm
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2017-1601
CVE.org
https://www.cve.org/CVERecord?id=CVE-2017-1601
Patch
http://www.ibm.com/support/docview.wss?uid=swg22014230
Third Party Advisory
http://www.securitytracker.com/id/1040899
VDB Entry
https://exchange.xforce.ibmcloud.com/vulnerabilities/132624
More from Security Guardium Database Activity Monitor
8.8
CVE-2016-0241
IBM Security Guardium Database Activity Monitor 8.2 before p310, 9.x through 9.5 before p700, and 10.x through 10.1 before p100 allows remote authenticated users to spoof…
8.8
CVE-2016-0239
IBM Security Guardium Database Activity Monitor 9.x through 9.5 before p700 and 10.x through 10.0.1 before p100 allows remote authenticated users to make HTTP requests with…
8.8
CVE-2016-0236
IBM Security Guardium Database Activity Monitor 8.2 before p310, 9.x through 9.5 before p700, and 10.x through 10.1 before p100 allows remote authenticated users to execute…
8.2
CVE-2016-0235
IBM Security Guardium Database Activity Monitor 10 allows local users to have unspecified impact by leveraging administrator access to a hardcoded password, related to use on GRUB…
7.8
CVE-2016-0328
IBM Security Guardium Database Activity Monitor 8.2 before p310, 9.x through 9.5 before p700, and 10.x through 10.1 before p100 allows local users to obtain administrator…