CVE-2012-4832
Vulnerability from cvelistv5
Published
2013-01-31 11:00
Modified
2024-08-06 20:50
Severity ?
Summary
Information Services Framework (ISF) in IBM InfoSphere Information Server 8.1, 8.5 before FP3, and 8.7 and InfoSphere Business Glossary 8.1.1 and 8.1.2 does not have an off autocomplete attribute for the password field on the login page, which makes it easier for remote attackers to obtain access by leveraging an unattended workstation.
References
psirt@us.ibm.comhttp://www-01.ibm.com/support/docview.wss?uid=swg21623501Vendor Advisory
psirt@us.ibm.comhttps://exchange.xforce.ibmcloud.com/vulnerabilities/78906
af854a3a-2127-422b-91ae-364da2661108http://www-01.ibm.com/support/docview.wss?uid=swg21623501Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108https://exchange.xforce.ibmcloud.com/vulnerabilities/78906
Impacted products
Vendor Product Version
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-06T20:50:17.333Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://www-01.ibm.com/support/docview.wss?uid=swg21623501"
          },
          {
            "name": "ibm-iis-loginpage-password-disclosure(78906)",
            "tags": [
              "vdb-entry",
              "x_refsource_XF",
              "x_transferred"
            ],
            "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/78906"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2013-01-25T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "Information Services Framework (ISF) in IBM InfoSphere Information Server 8.1, 8.5 before FP3, and 8.7 and InfoSphere Business Glossary 8.1.1 and 8.1.2 does not have an off autocomplete attribute for the password field on the login page, which makes it easier for remote attackers to obtain access by leveraging an unattended workstation."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2017-08-28T12:57:01",
        "orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
        "shortName": "ibm"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://www-01.ibm.com/support/docview.wss?uid=swg21623501"
        },
        {
          "name": "ibm-iis-loginpage-password-disclosure(78906)",
          "tags": [
            "vdb-entry",
            "x_refsource_XF"
          ],
          "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/78906"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "psirt@us.ibm.com",
          "ID": "CVE-2012-4832",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Information Services Framework (ISF) in IBM InfoSphere Information Server 8.1, 8.5 before FP3, and 8.7 and InfoSphere Business Glossary 8.1.1 and 8.1.2 does not have an off autocomplete attribute for the password field on the login page, which makes it easier for remote attackers to obtain access by leveraging an unattended workstation."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "http://www-01.ibm.com/support/docview.wss?uid=swg21623501",
              "refsource": "CONFIRM",
              "url": "http://www-01.ibm.com/support/docview.wss?uid=swg21623501"
            },
            {
              "name": "ibm-iis-loginpage-password-disclosure(78906)",
              "refsource": "XF",
              "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/78906"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
    "assignerShortName": "ibm",
    "cveId": "CVE-2012-4832",
    "datePublished": "2013-01-31T11:00:00",
    "dateReserved": "2012-09-06T00:00:00",
    "dateUpdated": "2024-08-06T20:50:17.333Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "fkie_nvd": {
      "configurations": "[{\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:ibm:infosphere_business_glossary:8.1.1:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"0BE8D7B9-C7A0-4AC4-B70C-E1EB69827DA9\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:ibm:infosphere_business_glossary:8.1.2:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"5D14BE62-362F-4386-A472-97D8B7013A3C\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:ibm:infosphere_information_server:8.1:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"317FAE67-76E2-4084-9393-8A02D255BAF5\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:ibm:infosphere_information_server:8.5:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"CA7096B4-291F-49BB-8DBC-E67AC901CF08\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:ibm:infosphere_information_server:8.5.0.1:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"D547E88D-FE3F-4C90-B7D8-301A1449E9AB\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:ibm:infosphere_information_server:8.5.0.2:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"5585D2C4-6575-4469-A6EF-CCDC3A0BEDB2\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:ibm:infosphere_information_server:8.7:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"42A9CF5C-79EC-4BBF-92AF-2AB3DC125684\"}]}]}]",
      "descriptions": "[{\"lang\": \"en\", \"value\": \"Information Services Framework (ISF) in IBM InfoSphere Information Server 8.1, 8.5 before FP3, and 8.7 and InfoSphere Business Glossary 8.1.1 and 8.1.2 does not have an off autocomplete attribute for the password field on the login page, which makes it easier for remote attackers to obtain access by leveraging an unattended workstation.\"}, {\"lang\": \"es\", \"value\": \"Information Services Framework (ISF) en IBM InfoSphere Information Server v8.1, v8.5 anterior a FP3, y 8.7 y InfoSphere Business Glossary v8.1.1 y v8.1.2 no tiene un atributo de no autocompletar el campo de contrase\\u00f1a en la p\\u00e1gina de inicio de sesi\\u00f3n, lo que hace que sea m\\u00e1s f\\u00e1cil por atacantes remotos obtener acceso mediante el aprovechamiento de una estaci\\u00f3n de trabajo sin vigilancia.\"}]",
      "evaluatorImpact": "Per: http://www-01.ibm.com/support/docview.wss?uid=swg21623501\r\n\r\n\"CVSS Base Score: 1.9 / CVSS Vector: (AV:L/AC:M/Au:N/C:P/I:N/A:N)\"\r\n\r\n",
      "id": "CVE-2012-4832",
      "lastModified": "2024-11-21T01:43:34.803",
      "metrics": "{\"cvssMetricV2\": [{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"2.0\", \"vectorString\": \"AV:L/AC:M/Au:N/C:P/I:N/A:N\", \"baseScore\": 1.9, \"accessVector\": \"LOCAL\", \"accessComplexity\": \"MEDIUM\", \"authentication\": \"NONE\", \"confidentialityImpact\": \"PARTIAL\", \"integrityImpact\": \"NONE\", \"availabilityImpact\": \"NONE\"}, \"baseSeverity\": \"LOW\", \"exploitabilityScore\": 3.4, \"impactScore\": 2.9, \"acInsufInfo\": false, \"obtainAllPrivilege\": false, \"obtainUserPrivilege\": false, \"obtainOtherPrivilege\": false, \"userInteractionRequired\": false}]}",
      "published": "2013-01-31T12:06:18.080",
      "references": "[{\"url\": \"http://www-01.ibm.com/support/docview.wss?uid=swg21623501\", \"source\": \"psirt@us.ibm.com\", \"tags\": [\"Vendor Advisory\"]}, {\"url\": \"https://exchange.xforce.ibmcloud.com/vulnerabilities/78906\", \"source\": \"psirt@us.ibm.com\"}, {\"url\": \"http://www-01.ibm.com/support/docview.wss?uid=swg21623501\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Vendor Advisory\"]}, {\"url\": \"https://exchange.xforce.ibmcloud.com/vulnerabilities/78906\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}]",
      "sourceIdentifier": "psirt@us.ibm.com",
      "vulnStatus": "Modified",
      "weaknesses": "[{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-200\"}]}]"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2012-4832\",\"sourceIdentifier\":\"psirt@us.ibm.com\",\"published\":\"2013-01-31T12:06:18.080\",\"lastModified\":\"2024-11-21T01:43:34.803\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Information Services Framework (ISF) in IBM InfoSphere Information Server 8.1, 8.5 before FP3, and 8.7 and InfoSphere Business Glossary 8.1.1 and 8.1.2 does not have an off autocomplete attribute for the password field on the login page, which makes it easier for remote attackers to obtain access by leveraging an unattended workstation.\"},{\"lang\":\"es\",\"value\":\"Information Services Framework (ISF) en IBM InfoSphere Information Server v8.1, v8.5 anterior a FP3, y 8.7 y InfoSphere Business Glossary v8.1.1 y v8.1.2 no tiene un atributo de no autocompletar el campo de contrase\u00f1a en la p\u00e1gina de inicio de sesi\u00f3n, lo que hace que sea m\u00e1s f\u00e1cil por atacantes remotos obtener acceso mediante el aprovechamiento de una estaci\u00f3n de trabajo sin vigilancia.\"}],\"metrics\":{\"cvssMetricV2\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"2.0\",\"vectorString\":\"AV:L/AC:M/Au:N/C:P/I:N/A:N\",\"baseScore\":1.9,\"accessVector\":\"LOCAL\",\"accessComplexity\":\"MEDIUM\",\"authentication\":\"NONE\",\"confidentialityImpact\":\"PARTIAL\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"NONE\"},\"baseSeverity\":\"LOW\",\"exploitabilityScore\":3.4,\"impactScore\":2.9,\"acInsufInfo\":false,\"obtainAllPrivilege\":false,\"obtainUserPrivilege\":false,\"obtainOtherPrivilege\":false,\"userInteractionRequired\":false}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-200\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:ibm:infosphere_business_glossary:8.1.1:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"0BE8D7B9-C7A0-4AC4-B70C-E1EB69827DA9\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:ibm:infosphere_business_glossary:8.1.2:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"5D14BE62-362F-4386-A472-97D8B7013A3C\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:ibm:infosphere_information_server:8.1:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"317FAE67-76E2-4084-9393-8A02D255BAF5\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:ibm:infosphere_information_server:8.5:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"CA7096B4-291F-49BB-8DBC-E67AC901CF08\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:ibm:infosphere_information_server:8.5.0.1:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"D547E88D-FE3F-4C90-B7D8-301A1449E9AB\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:ibm:infosphere_information_server:8.5.0.2:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"5585D2C4-6575-4469-A6EF-CCDC3A0BEDB2\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:ibm:infosphere_information_server:8.7:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"42A9CF5C-79EC-4BBF-92AF-2AB3DC125684\"}]}]}],\"references\":[{\"url\":\"http://www-01.ibm.com/support/docview.wss?uid=swg21623501\",\"source\":\"psirt@us.ibm.com\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"https://exchange.xforce.ibmcloud.com/vulnerabilities/78906\",\"source\":\"psirt@us.ibm.com\"},{\"url\":\"http://www-01.ibm.com/support/docview.wss?uid=swg21623501\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"https://exchange.xforce.ibmcloud.com/vulnerabilities/78906\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"}],\"evaluatorImpact\":\"Per: http://www-01.ibm.com/support/docview.wss?uid=swg21623501\\r\\n\\r\\n\\\"CVSS Base Score: 1.9 / CVSS Vector: (AV:L/AC:M/Au:N/C:P/I:N/A:N)\\\"\\r\\n\\r\\n\"}}"
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.