Lucene search

[email protected]CVE-2016-3028

HistoryNov 25, 2016 - 3:59 a.m.

CVE-2016-3028

2016-11-2503:59:07

CWE-78

[email protected]

web.nvd.nist.gov

ibm

security access manager

remote code execution

cve-2016-3028

nvd

lmi admin access

9 High

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:S/C:C/I:C/A:C

9.1 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

9.2 High

AI Score

Confidence

High

0.011 Low

EPSS

Percentile

84.3%

JSON

IBM Security Access Manager for Web 7.0 before IF2 and 8.0 before 8.0.1.4 IF3 and Security Access Manager 9.0 before 9.0.1.0 IF5 allow remote authenticated users to execute arbitrary commands by leveraging LMI admin access.

Affected configurations

NVD

Node

ibmsecurity_access_managerMatch9.0.0

ibmsecurity_access_managerMatch9.0.0.1

ibmsecurity_access_managerMatch9.0.1.0

ibmsecurity_access_manager_for_webMatch7.0.0

ibmsecurity_access_manager_for_webMatch8.0.0

ibmsecurity_access_manager_for_webMatch8.0.0.2

ibmsecurity_access_manager_for_webMatch8.0.0.4

ibmsecurity_access_manager_for_webMatch8.0.0.5

ibmsecurity_access_manager_for_webMatch8.0.1

ibmsecurity_access_manager_for_webMatch8.0.1.2

ibmsecurity_access_manager_for_webMatch8.0.1.3

ibmsecurity_access_manager_for_webMatch8.0.1.4

CPENameOperatorVersion
ibm:security_access_manageribm security access managereq9.0.0
ibm:security_access_manageribm security access managereq9.0.0.1
ibm:security_access_manageribm security access managereq9.0.1.0
ibm:security_access_manager_for_webibm security access manager for webeq7.0.0
ibm:security_access_manager_for_webibm security access manager for webeq8.0.0
ibm:security_access_manager_for_webibm security access manager for webeq8.0.0.2
ibm:security_access_manager_for_webibm security access manager for webeq8.0.0.4
ibm:security_access_manager_for_webibm security access manager for webeq8.0.0.5
ibm:security_access_manager_for_webibm security access manager for webeq8.0.1
ibm:security_access_manager_for_webibm security access manager for webeq8.0.1.2

CPE	Name	Operator	Version
ibm:security_access_manager	ibm security access manager	eq	9.0.0
ibm:security_access_manager	ibm security access manager	eq	9.0.0.1
ibm:security_access_manager	ibm security access manager	eq	9.0.1.0
ibm:security_access_manager_for_web	ibm security access manager for web	eq	7.0.0
ibm:security_access_manager_for_web	ibm security access manager for web	eq	8.0.0
ibm:security_access_manager_for_web	ibm security access manager for web	eq	8.0.0.2
ibm:security_access_manager_for_web	ibm security access manager for web	eq	8.0.0.4
ibm:security_access_manager_for_web	ibm security access manager for web	eq	8.0.0.5
ibm:security_access_manager_for_web	ibm security access manager for web	eq	8.0.1
ibm:security_access_manager_for_web	ibm security access manager for web	eq	8.0.1.2

Rows per page:

1-10 of 121

References

www-01.ibm.com/support/docview.wss?uid=swg1IV89257

www-01.ibm.com/support/docview.wss?uid=swg1IV89322

www-01.ibm.com/support/docview.wss?uid=swg1IV89326

www-01.ibm.com/support/docview.wss?uid=swg21990317

www.securityfocus.com/bid/93176

9 High

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:S/C:C/I:C/A:C

9.1 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

9.2 High

AI Score

Confidence

High

0.011 Low

EPSS

Percentile

84.3%

JSON

Related for CVE-2016-3028

ibm2 cvelist1 prion1 nvd1