PT-2013-1723 · Ibm · Ibm Infosphere Information Server+1

Published 2013-01-31 · Updated 2017-08-29 · CVE-2012-4832

Positive Technologies (AI Summary)

CVSS v2.0

1.9

Low

Base vector

AV:L/AC:M/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Information Services Framework (ISF) in IBM InfoSphere Information Server versions 8.1 through 8.5 before FP3, 8.7 Information Services Framework (ISF) in IBM InfoSphere Business Glossary versions 8.1.1 through 8.1.2

Description The issue makes it easier for remote attackers to obtain access by leveraging an unattended workstation, as the login page does not have an off autocomplete attribute for the password field.

Recommendations For IBM InfoSphere Information Server versions 8.1 through 8.5 before FP3, 8.7, consider disabling the login page's autocomplete feature for the password field until a patch is available. For IBM InfoSphere Business Glossary versions 8.1.1 through 8.1.2, consider disabling the login page's autocomplete feature for the password field until a patch is available.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2012-4832

Affected Products

Ibm Infosphere Business Glossary

Ibm Infosphere Information Server

References · 3

• http://www-01.ibm.com/support/docview.wss?uid=swg21623501 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2012-4832 · Security Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/78906 · Note