cnvd - cnvd-2016-13274

CNVD-2016-13274

Vulnerability from cnvd - Published: 2016-12-29

Title

IBM Security Access Manager for Web信息泄露漏洞（CNVD-2016-13274）

Description

IBM Security Access Manager（ISAM）等都是美国IBM公司的产品。ISAM是一款安全访问管理器；IBM Security Access Manager for Web是一套通过一个模块式软件包提供移动访问安全防护的解决方案。 IBM Security Access Manager for Web存在信息泄露漏洞。攻击者可利用该漏洞获取敏感信息。

Severity

中

Patch Name

IBM Security Access Manager for Web信息泄露漏洞（CNVD-2016-13274）的补丁

Patch Description

Formal description

目前厂商已经发布了升级补丁以修复此安全问题，补丁获取链接： http://www-01.ibm.com/support/docview.wss?uid=swg21995435

Reference

http://www.securityfocus.com/bid/95103

Impacted products

Name
['IBM Security Access Manager for Web 7.0', 'IBM Security Access Manager for Web >=8.0.0.0，<=8.0.1.4', 'IBM Security Access Manager For Mobile >=8.0.0.0，<=8.0.1.4', 'IBM Security Access Manager >=9.0，<=9.0.1.0']

Show details on source website

JSON

To clipboard

{
  "bids": {
    "bid": {
      "bidNumber": "95103"
    }
  },
  "cves": {
    "cve": {
      "cveNumber": "CVE-2016-3045",
      "cveUrl": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-3045"
    }
  },
  "description": "IBM Security Access Manager\uff08ISAM\uff09\u7b49\u90fd\u662f\u7f8e\u56fdIBM\u516c\u53f8\u7684\u4ea7\u54c1\u3002ISAM\u662f\u4e00\u6b3e\u5b89\u5168\u8bbf\u95ee\u7ba1\u7406\u5668\uff1bIBM Security Access Manager for Web\u662f\u4e00\u5957\u901a\u8fc7\u4e00\u4e2a\u6a21\u5757\u5f0f\u8f6f\u4ef6\u5305\u63d0\u4f9b\u79fb\u52a8\u8bbf\u95ee\u5b89\u5168\u9632\u62a4\u7684\u89e3\u51b3\u65b9\u6848\u3002\r\n\r\nIBM Security Access Manager for Web\u5b58\u5728\u4fe1\u606f\u6cc4\u9732\u6f0f\u6d1e\u3002\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u83b7\u53d6\u654f\u611f\u4fe1\u606f\u3002",
  "discovererName": "IBM",
  "formalWay": "\u76ee\u524d\u5382\u5546\u5df2\u7ecf\u53d1\u5e03\u4e86\u5347\u7ea7\u8865\u4e01\u4ee5\u4fee\u590d\u6b64\u5b89\u5168\u95ee\u9898\uff0c\u8865\u4e01\u83b7\u53d6\u94fe\u63a5\uff1a\r\nhttp://www-01.ibm.com/support/docview.wss?uid=swg21995435",
  "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
  "number": "CNVD-2016-13274",
  "openTime": "2016-12-29",
  "patchDescription": "IBM Security Access Manager\uff08ISAM\uff09\u7b49\u90fd\u662f\u7f8e\u56fdIBM\u516c\u53f8\u7684\u4ea7\u54c1\u3002ISAM\u662f\u4e00\u6b3e\u5b89\u5168\u8bbf\u95ee\u7ba1\u7406\u5668\uff1bIBM Security Access Manager for Web\u662f\u4e00\u5957\u901a\u8fc7\u4e00\u4e2a\u6a21\u5757\u5f0f\u8f6f\u4ef6\u5305\u63d0\u4f9b\u79fb\u52a8\u8bbf\u95ee\u5b89\u5168\u9632\u62a4\u7684\u89e3\u51b3\u65b9\u6848\u3002\r\n\r\nIBM Security Access Manager for Web\u5b58\u5728\u4fe1\u606f\u6cc4\u9732\u6f0f\u6d1e\u3002\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u83b7\u53d6\u654f\u611f\u4fe1\u606f\u3002\u76ee\u524d\uff0c\u4f9b\u5e94\u5546\u53d1\u5e03\u4e86\u5b89\u5168\u516c\u544a\u53ca\u76f8\u5173\u8865\u4e01\u4fe1\u606f\uff0c\u4fee\u590d\u4e86\u6b64\u6f0f\u6d1e\u3002",
  "patchName": "IBM Security Access Manager for Web\u4fe1\u606f\u6cc4\u9732\u6f0f\u6d1e\uff08CNVD-2016-13274\uff09\u7684\u8865\u4e01",
  "products": {
    "product": [
      "IBM Security Access Manager for Web 7.0",
      "IBM Security Access Manager for Web \u003e=8.0.0.0\uff0c\u003c=8.0.1.4",
      "IBM Security Access Manager For Mobile \u003e=8.0.0.0\uff0c\u003c=8.0.1.4",
      "IBM Security Access Manager \u003e=9.0\uff0c\u003c=9.0.1.0"
    ]
  },
  "referenceLink": "http://www.securityfocus.com/bid/95103",
  "serverity": "\u4e2d",
  "submitTime": "2016-12-28",
  "title": "IBM Security Access Manager for Web\u4fe1\u606f\u6cc4\u9732\u6f0f\u6d1e\uff08CNVD-2016-13274\uff09"
}

CVE-2016-3045 (GCVE-0-2016-3045)

Vulnerability from cvelistv5 – Published: 2017-02-01 20:00 – Updated: 2024-08-05 23:40

Summary

IBM Security Access Manager for Web stores sensitive information in URL parameters. This may lead to information disclosure if unauthorized parties have access to the URLs via server logs, referer header or browser history.

Severity ?

No CVSS data available.

CWE

Obtain Information

Assigner

ibm

References

URL

Tags

	http://www.ibm.com/support/docview.wss?uid=swg21995435	x_refsource_CONFIRM
	http://www.securityfocus.com/bid/95103	vdb-entryx_refsource_BID

Impacted products

	Vendor	Product	Version
	IBM Corporation	Access Manager	Affected: 9.0 Affected: 9.0.0.1 Affected: 9.0.1 Affected: 7.0.0 Affected: 8.0.0 Affected: 8.0.0.1 Affected: 8.0.0.2 Affected: 8.0.0.3 Affected: 8.0.0.4 Affected: 8.0.0.5 Affected: 8.0.1 Affected: 8.0.1.2 Affected: 8.0.1.3 Affected: 8.0.1.4 Affected: 9.0.0 Affected: 9.0.1.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T23:40:15.078Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://www.ibm.com/support/docview.wss?uid=swg21995435"
          },
          {
            "name": "95103",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/95103"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Access Manager",
          "vendor": "IBM Corporation",
          "versions": [
            {
              "status": "affected",
              "version": "9.0"
            },
            {
              "status": "affected",
              "version": "9.0.0.1"
            },
            {
              "status": "affected",
              "version": "9.0.1"
            },
            {
              "status": "affected",
              "version": "7.0.0"
            },
            {
              "status": "affected",
              "version": "8.0.0"
            },
            {
              "status": "affected",
              "version": "8.0.0.1"
            },
            {
              "status": "affected",
              "version": "8.0.0.2"
            },
            {
              "status": "affected",
              "version": "8.0.0.3"
            },
            {
              "status": "affected",
              "version": "8.0.0.4"
            },
            {
              "status": "affected",
              "version": "8.0.0.5"
            },
            {
              "status": "affected",
              "version": "8.0.1"
            },
            {
              "status": "affected",
              "version": "8.0.1.2"
            },
            {
              "status": "affected",
              "version": "8.0.1.3"
            },
            {
              "status": "affected",
              "version": "8.0.1.4"
            },
            {
              "status": "affected",
              "version": "9.0.0"
            },
            {
              "status": "affected",
              "version": "9.0.1.0"
            }
          ]
        }
      ],
      "datePublic": "2017-02-01T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "IBM Security Access Manager for Web stores sensitive information in URL parameters. This may lead to information disclosure if unauthorized parties have access to the URLs via server logs, referer header or browser history."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Obtain Information",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2017-02-02T10:57:01",
        "orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
        "shortName": "ibm"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://www.ibm.com/support/docview.wss?uid=swg21995435"
        },
        {
          "name": "95103",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/95103"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "psirt@us.ibm.com",
          "ID": "CVE-2016-3045",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Access Manager",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "9.0"
                          },
                          {
                            "version_value": "9.0.0.1"
                          },
                          {
                            "version_value": "9.0.1"
                          },
                          {
                            "version_value": "7.0.0"
                          },
                          {
                            "version_value": "8.0.0"
                          },
                          {
                            "version_value": "8.0.0.1"
                          },
                          {
                            "version_value": "8.0.0.2"
                          },
                          {
                            "version_value": "8.0.0.3"
                          },
                          {
                            "version_value": "8.0.0.4"
                          },
                          {
                            "version_value": "8.0.0.5"
                          },
                          {
                            "version_value": "8.0.1"
                          },
                          {
                            "version_value": "8.0.1.2"
                          },
                          {
                            "version_value": "8.0.1.3"
                          },
                          {
                            "version_value": "8.0.1.4"
                          },
                          {
                            "version_value": "9.0.0"
                          },
                          {
                            "version_value": "9.0.1.0"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "IBM Corporation"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "IBM Security Access Manager for Web stores sensitive information in URL parameters. This may lead to information disclosure if unauthorized parties have access to the URLs via server logs, referer header or browser history."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "Obtain Information"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "http://www.ibm.com/support/docview.wss?uid=swg21995435",
              "refsource": "CONFIRM",
              "url": "http://www.ibm.com/support/docview.wss?uid=swg21995435"
            },
            {
              "name": "95103",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/95103"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
    "assignerShortName": "ibm",
    "cveId": "CVE-2016-3045",
    "datePublished": "2017-02-01T20:00:00",
    "dateReserved": "2016-03-09T00:00:00",
    "dateUpdated": "2024-08-05T23:40:15.078Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

CNVD-2016-13274

CVE-2016-3045 (GCVE-0-2016-3045)

Tags

Sightings

Nomenclature