PT-2017-9911 · Ibm · Ibm Bigfix Inventory

Published 2017-02-01 · Updated 2017-02-13 · CVE-2016-8977

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions IBM BigFix Inventory version 9

Description The issue could disclose sensitive information to an unauthorized user using HTTP GET requests, potentially allowing for further attacks against the system.

Recommendations For IBM BigFix Inventory version 9, consider restricting access to sensitive information and limiting the use of HTTP GET requests until a fix is available. As a temporary workaround, restrict access to the system to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2016-8977

Affected Products

Ibm Bigfix Inventory

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2016-8977 · Security Note
• http://ibm.com/support/docview.wss?uid=swg21995014 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2016-8977 · Vendor Advisory
• http://securityfocus.com/bid/95308 · Note