Lucene search

[email protected]CVE-2014-6176

HistoryDec 16, 2014 - 11:59 p.m.

CVE-2014-6176

2014-12-1623:59:02

CWE-310

[email protected]

web.nvd.nist.gov

ibm

websphere

process server

enterprise service bus

business process manager

sslv3

vulnerability

nvd

4.3 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:M/Au:N/C:P/I:N/A:N

6.1 Medium

AI Score

Confidence

Low

0.003 Low

EPSS

Percentile

65.3%

JSON

IBM WebSphere Process Server 7.0, WebSphere Enterprise Service Bus 7.0, and Business Process Manager Advanced 7.5.x through 7.5.1.2, 8.0.x through 8.0.1.3, and 8.5.x through 8.5.5 disregard the SSL setting in the SCA module HTTP import binding and unconditionally select the SSLv3 protocol, which makes it easier for remote attackers to hijack sessions or obtain sensitive information by leveraging the use of a weak cipher.

Affected configurations

NVD

Node

ibmbusiness_process_managerMatch7.5.0.0advanced

ibmbusiness_process_managerMatch7.5.0.1advanced

ibmbusiness_process_managerMatch7.5.1.0advanced

ibmbusiness_process_managerMatch7.5.1.1advanced

ibmbusiness_process_managerMatch8.0.0.0advanced

ibmbusiness_process_managerMatch8.0.1.0advanced

ibmbusiness_process_managerMatch8.0.1.1advanced

ibmbusiness_process_managerMatch8.0.1.2advanced

ibmbusiness_process_managerMatch8.0.1.3advanced

ibmbusiness_process_managerMatch8.5.0.0advanced

ibmbusiness_process_managerMatch8.5.0.1advanced

ibmbusiness_process_managerMatch8.5.5.0advanced

Node

ibmwebsphere_enterprise_service_busMatch7.0

Node

ibmwebsphere_process_serverMatch7.0

CPENameOperatorVersion
ibm:business_process_manageribm business process managereq7.5.0.0
ibm:business_process_manageribm business process managereq7.5.0.1
ibm:business_process_manageribm business process managereq7.5.1.0
ibm:business_process_manageribm business process managereq7.5.1.1
ibm:business_process_manageribm business process managereq8.0.0.0
ibm:business_process_manageribm business process managereq8.0.1.0
ibm:business_process_manageribm business process managereq8.0.1.1
ibm:business_process_manageribm business process managereq8.0.1.2
ibm:business_process_manageribm business process managereq8.0.1.3
ibm:business_process_manageribm business process managereq8.5.0.0

CPE	Name	Operator	Version
ibm:business_process_manager	ibm business process manager	eq	7.5.0.0
ibm:business_process_manager	ibm business process manager	eq	7.5.0.1
ibm:business_process_manager	ibm business process manager	eq	7.5.1.0
ibm:business_process_manager	ibm business process manager	eq	7.5.1.1
ibm:business_process_manager	ibm business process manager	eq	8.0.0.0
ibm:business_process_manager	ibm business process manager	eq	8.0.1.0
ibm:business_process_manager	ibm business process manager	eq	8.0.1.1
ibm:business_process_manager	ibm business process manager	eq	8.0.1.2
ibm:business_process_manager	ibm business process manager	eq	8.0.1.3
ibm:business_process_manager	ibm business process manager	eq	8.5.0.0

Rows per page:

1-10 of 121

References

www-01.ibm.com/support/docview.wss?uid=swg1JR51593

www-01.ibm.com/support/docview.wss?uid=swg21690780

www.securitytracker.com/id/1031382

www.securitytracker.com/id/1031383

exchange.xforce.ibmcloud.com/vulnerabilities/98488

4.3 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:M/Au:N/C:P/I:N/A:N

6.1 Medium

AI Score

Confidence

Low

0.003 Low

EPSS

Percentile

65.3%

JSON

Related for CVE-2014-6176

cvelist1 ibm1 prion1 nvd1