PT-2018-4125 · Ibm · Ibm Security Key Lifecycle Manager

Publicado 2018-04-25 · Atualizado 2018-06-13 · CVE-2014-0872

Positive Technologies (AI Summary)

CVSS v2.0

1.5

Baixa

Vetor base

AV:L/AC:M/Au:S/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions IBM Security Key Lifecycle Manager version 2.5

Description The installation process stores unencrypted credentials, potentially allowing local users with root access to obtain sensitive information.

Recommendations For IBM Security Key Lifecycle Manager version 2.5, consider restricting root access to minimize the risk of exploitation until a fix is available.

Correção

Information Disclosure

Enumeração de Fraquezas

CWE-255

CWE-200

Identificadores relacionados

CVE-2014-0872

Produtos afetados

Ibm Security Key Lifecycle Manager

Referências · 3

• https://nvd.nist.gov/vuln/detail/CVE-2014-0872 · Nota de Segurança
• https://exchange.xforce.ibmcloud.com/vulnerabilities/90988 · Aviso do Fabricante
• https://ibm.com/blogs/psirt/ibm-security-bulletin-unencrypted-credentials-stored-on-ibm-security-key-lifecycle-manager-server-cve-2014-0872 · Aviso do Fabricante