Lucene search

[email protected]NVD:CVE-2012-5756

HistoryNov 23, 2012 - 12:09 p.m.

CVE-2012-5756

2012-11-2312:09:55

CWE-310

[email protected]

web.nvd.nist.gov

4.3 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

6.5 Medium

AI Score

Confidence

Low

0.004 Low

EPSS

Percentile

72.4%

JSON

The IBM WebSphere DataPower XC10 Appliance 2.0.0.0 through 2.0.0.3 and 2.1.0.0 through 2.1.0.2, when a collective configuration is enabled, has a single secret key that is shared across different customers’ installations, which allows remote attackers to spoof a container server by (1) sniffing the network to locate a cleartext transmission of this key or (2) leveraging knowledge of this key from another installation.

Affected configurations

NVD

Node

ibmwebsphere_datapower_xc10_applianceMatch2.0.0.0

ibmwebsphere_datapower_xc10_applianceMatch2.0.0.1

ibmwebsphere_datapower_xc10_applianceMatch2.0.0.2

ibmwebsphere_datapower_xc10_applianceMatch2.0.0.3

ibmwebsphere_datapower_xc10_applianceMatch2.1.0.0

ibmwebsphere_datapower_xc10_applianceMatch2.1.0.1

ibmwebsphere_datapower_xc10_applianceMatch2.1.0.2

References

secunia.com/advisories/51319

www-01.ibm.com/support/docview.wss?uid=swg1PM68926

www-01.ibm.com/support/docview.wss?uid=swg21615783

www-01.ibm.com/support/docview.wss?uid=swg24033740

www.securityfocus.com/bid/56617

www.securitytracker.com/id?1027798

exchange.xforce.ibmcloud.com/vulnerabilities/79921

4.3 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

6.5 Medium

AI Score

Confidence

Low

0.004 Low

EPSS

Percentile

72.4%

JSON

Related for NVD:CVE-2012-5756

cve1 prion1 cvelist1 ibm1