PT-2016-3653 · Ibm · Ibm Security Access Manager For Web

Chris Shepherd + 5 · Published 2016-02-15 · Updated 2016-03-10 · CVE-2015-5010

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions IBM Security Access Manager for Web versions 7.0 through 7.0.0 IF20 IBM Security Access Manager for Web versions 8.0 through 8.0.1.3 IF3 IBM Security Access Manager for Web versions 9.0 through 9.0.0.0

Description The issue is related to the lack of a lockout mechanism for invalid login attempts, making it easier for remote attackers to obtain access via a brute-force attack.

Recommendations For versions 7.0 through 7.0.0 IF20, update to 7.0.0 IF21 or later. For versions 8.0 through 8.0.1.3 IF3, update to 8.0.1.3 IF4 or later. For versions 9.0 through 9.0.0.0, update to 9.0.0.1 IF1 or later.

Fix

Weakness Enumeration

CWE-254

Related Identifiers

CVE-2015-5010

Affected Products

Ibm Security Access Manager For Web

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2015-5010 · Security Note
• http://www-01.ibm.com/support/docview.wss?uid=swg21970508 · Vendor Advisory
• http://www-01.ibm.com/support/docview.wss?uid=swg1IV80694 · Vendor Advisory
• http://www-01.ibm.com/support/docview.wss?uid=swg1IV80728 · Vendor Advisory