CVE-2014-6136

IBM Security AppScan Standard 8.x and 9.x before 9.0.1.1 FP1 supports unencrypted sessions, which allows remote attackers to obtain sensitive information by sniffing the network.

CVSS v2.0 5.0 MEDIUM

5.0^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:L/Au:N/C:P/I:N/A:N

Exploitability : 10.0 / Impact : 2.9

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact NONE

Availability Impact NONE

References

Link	Resource
http://www-01.ibm.com/support/docview.wss?uid=swg21695170	Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/96816
http://www-01.ibm.com/support/docview.wss?uid=swg21695170	Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/96816

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:ibm:security_appscan:8.0.0.0::::standard:::
	cpe:2.3:a:ibm:security_appscan:8.0.0.1::::standard:::
	cpe:2.3:a:ibm:security_appscan:8.0.0.2::::standard:::
	cpe:2.3:a:ibm:security_appscan:8.0.0.3::::standard:::
	cpe:2.3:a:ibm:security_appscan:8.5.0.0::::standard:::
	cpe:2.3:a:ibm:security_appscan:8.5.0.1::::standard:::
	cpe:2.3:a:ibm:security_appscan:8.6.0.0::::standard:::
	cpe:2.3:a:ibm:security_appscan:8.6.0.1::::standard:::
	cpe:2.3:a:ibm:security_appscan:8.7.0.0::::standard:::
	cpe:2.3:a:ibm:security_appscan:8.7.0.1::::standard:::
	cpe:2.3:a:ibm:security_appscan:8.8.0.0::::standard:::
	cpe:2.3:a:ibm:security_appscan:9.0.0.0::::standard:::
	cpe:2.3:a:ibm:security_appscan:9.0.0.1::::standard:::
	cpe:2.3:a:ibm:security_appscan:9.0.1.0::::standard:::
	cpe:2.3:a:ibm:security_appscan:9.0.1.1::::standard:::

History

No history.

Information

Published : 2015-02-02 01:59

Updated : 2025-04-12 10:46

NVD link : CVE-2014-6136

Mitre link : CVE-2014-6136

CVE.ORG link : CVE-2014-6136

JSON object : View

Products Affected

ibm

security_appscan

CWE

CWE-310

Cryptographic Issues

{"id": "CVE-2014-6136", "cveTags": [], "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 5.0, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N", "authentication": "NONE", "integrityImpact": "NONE", "accessComplexity": "LOW", "availabilityImpact": "NONE", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}]}, "published": "2015-02-02T01:59:00.047", "references": [{"url": "http://www-01.ibm.com/support/docview.wss?uid=swg21695170", "tags": ["Vendor Advisory"], "source": "psirt@us.ibm.com"}, {"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/96816", "source": "psirt@us.ibm.com"}, {"url": "http://www-01.ibm.com/support/docview.wss?uid=swg21695170", "tags": ["Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/96816", "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-310"}]}], "descriptions": [{"lang": "en", "value": "IBM Security AppScan Standard 8.x and 9.x before 9.0.1.1 FP1 supports unencrypted sessions, which allows remote attackers to obtain sensitive information by sniffing the network."}, {"lang": "es", "value": "IBM Security AppScan Standard 8.x y 9.x anterior a 9.0.1.1 FP1 soporta sesiones no codificadas, lo que permite a atacantes remotos obtener informaci\u00f3n sensible mediante la captura de trafico de la red."}], "lastModified": "2025-04-12T10:46:40.837", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:ibm:security_appscan:8.0.0.0:*:*:*:standard:*:*:*", "vulnerable": true, "matchCriteriaId": "05FE51A6-31D3-45B5-A88A-CDEDE590CDA3"}, {"criteria": "cpe:2.3:a:ibm:security_appscan:8.0.0.1:*:*:*:standard:*:*:*", "vulnerable": true, "matchCriteriaId": "76E9627D-0EAB-4D95-BBE0-5AA66C246764"}, {"criteria": "cpe:2.3:a:ibm:security_appscan:8.0.0.2:*:*:*:standard:*:*:*", "vulnerable": true, "matchCriteriaId": "18438CD2-3760-478E-BCF0-D337B147D904"}, {"criteria": "cpe:2.3:a:ibm:security_appscan:8.0.0.3:*:*:*:standard:*:*:*", "vulnerable": true, "matchCriteriaId": "52713448-1141-4EB8-A763-3D924420E362"}, {"criteria": "cpe:2.3:a:ibm:security_appscan:8.5.0.0:*:*:*:standard:*:*:*", "vulnerable": true, "matchCriteriaId": "C810EAB3-53FC-45C0-AED0-6E15F86FB86B"}, {"criteria": "cpe:2.3:a:ibm:security_appscan:8.5.0.1:*:*:*:standard:*:*:*", "vulnerable": true, "matchCriteriaId": "AE3CC10D-36CF-46DA-8A57-D5170B2D0C28"}, {"criteria": "cpe:2.3:a:ibm:security_appscan:8.6.0.0:*:*:*:standard:*:*:*", "vulnerable": true, "matchCriteriaId": "37309107-ABA9-4B48-B6A3-84608C6D2406"}, {"criteria": "cpe:2.3:a:ibm:security_appscan:8.6.0.1:*:*:*:standard:*:*:*", "vulnerable": true, "matchCriteriaId": "58610314-31BE-4209-9D27-0C0A4A0722E2"}, {"criteria": "cpe:2.3:a:ibm:security_appscan:8.7.0.0:*:*:*:standard:*:*:*", "vulnerable": true, "matchCriteriaId": "A37494E7-92CC-46D2-96E4-5A44C47A8280"}, {"criteria": "cpe:2.3:a:ibm:security_appscan:8.7.0.1:*:*:*:standard:*:*:*", "vulnerable": true, "matchCriteriaId": "A8EB6F2E-1A29-417C-A28E-865324FFF7FC"}, {"criteria": "cpe:2.3:a:ibm:security_appscan:8.8.0.0:*:*:*:standard:*:*:*", "vulnerable": true, "matchCriteriaId": "869C4237-8FB5-4433-AA51-9FDE2AF9B1CC"}, {"criteria": "cpe:2.3:a:ibm:security_appscan:9.0.0.0:*:*:*:standard:*:*:*", "vulnerable": true, "matchCriteriaId": "E2C2DF51-B9ED-4F03-9FFB-FAE8E6308FAB"}, {"criteria": "cpe:2.3:a:ibm:security_appscan:9.0.0.1:*:*:*:standard:*:*:*", "vulnerable": true, "matchCriteriaId": "EA28F9E1-CEB9-4BBC-BAFC-1E9530C6BF55"}, {"criteria": "cpe:2.3:a:ibm:security_appscan:9.0.1.0:*:*:*:standard:*:*:*", "vulnerable": true, "matchCriteriaId": "E4819FF1-6E25-459B-B85B-4525856C5747"}, {"criteria": "cpe:2.3:a:ibm:security_appscan:9.0.1.1:*:*:*:standard:*:*:*", "vulnerable": true, "matchCriteriaId": "92EB3451-C14D-438C-AA9C-07DAB4845DA6"}], "operator": "OR"}]}], "sourceIdentifier": "psirt@us.ibm.com"}