CVE-2014-8923

2015-03-2501:59:00

CWE-200

[email protected]

web.nvd.nist.gov

ibm tivoli

ibm security identity manager

active directory

cleartext password

log file

vulnerability

nvd

cve-2014-8923

5.8 Medium

AI Score

Confidence

Low

1.9 Low

CVSS2

Access Vector

LOCAL

Access Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:L/AC:M/Au:N/C:P/I:N/A:N

0.0004 Low

EPSS

Percentile

5.3%

JSON

The (1) IBM Tivoli Identity Manager Active Directory adapter before 5.1.24 and (2) IBM Security Identity Manager Active Directory adapter before 6.0.14 for IBM Security Identity Manager on Windows, when certain log and trace levels are configured, store the cleartext administrator password in a log file, which allows local users to obtain sensitive information by reading a file.

CPENameOperatorVersion
ibm:security_identity_manager_active_directory_adapteribm security identity manager active directory adapterle6.0.14
ibm:tivoli_identity_manager_active_directory_adapteribm tivoli identity manager active directory adapterle5.1.20

CPE	Name	Operator	Version
ibm:security_identity_manager_active_directory_adapter	ibm security identity manager active directory adapter	le	6.0.14
ibm:tivoli_identity_manager_active_directory_adapter	ibm tivoli identity manager active directory adapter	le	5.1.20