CVE-2014-0921

2014-04-1523:13:17

CWE-20

[email protected]

web.nvd.nist.gov

ibm messagesight

cve-2014-0921

denial of service

websockets

security vulnerability

4.3 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:N/I:N/A:P

7.3 High

AI Score

Confidence

High

0.008 Low

EPSS

Percentile

81.2%

JSON

The server in IBM MessageSight 1.x before 1.1.0.0-IBM-IMA-IT01015 allows remote attackers to cause a denial of service (daemon crash and message data loss) via malformed headers during a WebSockets connection upgrade.

Affected configurations

NVD

Node

ibmmessagesight_jms_clientMatch1.0.0.0

ibmmessagesight_jms_clientMatch1.0.0.1

ibmmessagesight_jms_clientMatch1.1.0.0

AND

ibmmessagesightMatch-

CPENameOperatorVersion
ibm:messagesight_jms_clientibm messagesight jms clienteq1.0.0.0
ibm:messagesight_jms_clientibm messagesight jms clienteq1.0.0.1
ibm:messagesight_jms_clientibm messagesight jms clienteq1.1.0.0
ibm:messagesightibm messagesighteq-

CPE	Name	Operator	Version
ibm:messagesight_jms_client	ibm messagesight jms client	eq	1.0.0.0
ibm:messagesight_jms_client	ibm messagesight jms client	eq	1.0.0.1
ibm:messagesight_jms_client	ibm messagesight jms client	eq	1.1.0.0
ibm:messagesight	ibm messagesight	eq	-