PT-2012-3846 · Ibm · Ibm Websphere Application Server

Publicado 2012-05-01 · Atualizado 2017-08-29 · CVE-2012-2162

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Média

Vetor base

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions IBM WebSphere Application Server (WAS) versions 8.0 and earlier

Description The issue allows remote attackers to obtain sensitive information by sniffing the network or spoof arbitrary servers via a man-in-the-middle attack due to the use of unencrypted HTTP communication after the expiration of the plugin-key.kdb password.

Recommendations For IBM WebSphere Application Server (WAS) versions 8.0 and earlier, update the plugin-key.kdb password to prevent the use of unencrypted HTTP communication.

Correção

Enumeração de Fraquezas

CWE-310

Identificadores relacionados

CVE-2012-2162

Produtos afetados

Ibm Websphere Application Server

Referências · 5

• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-2162 · Nota
• http://www-01.ibm.com/support/docview.wss?uid=swg21588312 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2012-2162 · Nota de Segurança
• https://exchange.xforce.ibmcloud.com/vulnerabilities/74900 · Nota
• http://www-01.ibm.com/support/docview.wss?uid=swg21591172 · Aviso do Fabricante