CVE-2016-0339

IBM Security Identity Manager (ISIM) Virtual Appliance 7.0.0.0 through 7.0.1.1 before 7.0.1-ISS-SIM-FP0003 mishandles session identifiers after logout, which makes it easier for remote attackers to spoof users by leveraging knowledge of "traffic records."

CVSS v3 5.6 MEDIUM
CVSS v2.0 4.3 MEDIUM

5.6^/10

CVSS v3 : MEDIUM

Vector : AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L

Exploitability : 2.2 / Impact : 3.4

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required NONE

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact LOW

Scope UNCHANGED

4.3^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:M/Au:N/C:N/I:P/A:N

Exploitability : 8.6 / Impact : 2.9

Access Vector NETWORK

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact NONE

Integrity Impact PARTIAL

Availability Impact NONE

References

Link	Resource
http://www-01.ibm.com/support/docview.wss?uid=swg21985736	Vendor Advisory
http://www.securityfocus.com/bid/91689
http://www.securitytracker.com/id/1036255
http://www-01.ibm.com/support/docview.wss?uid=swg21985736	Vendor Advisory
http://www.securityfocus.com/bid/91689
http://www.securitytracker.com/id/1036255

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:ibm:security_identity_manager_adapter:7.0.0.0:::::::*
	cpe:2.3:a:ibm:security_identity_manager_adapter:7.0.0.1:::::::*
	cpe:2.3:a:ibm:security_identity_manager_adapter:7.0.0.2:::::::*
	cpe:2.3:a:ibm:security_identity_manager_adapter:7.0.0.3:::::::*
	cpe:2.3:a:ibm:security_identity_manager_adapter:7.0.1.0:::::::*
	cpe:2.3:a:ibm:security_identity_manager_adapter:7.0.1.1:::::::*

History

No history.

Information

Published : 2016-07-15 18:59

Updated : 2025-04-12 10:46

NVD link : CVE-2016-0339

Mitre link : CVE-2016-0339

CVE.ORG link : CVE-2016-0339

JSON object : View

Products Affected

ibm

security_identity_manager_adapter

CWE

CWE-284

Improper Access Control

{"id": "CVE-2016-0339", "cveTags": [], "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 4.3, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "MEDIUM", "availabilityImpact": "NONE", "confidentialityImpact": "NONE"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.6, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV30": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.0", "baseScore": 5.6, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 3.4, "exploitabilityScore": 2.2}]}, "published": "2016-07-15T18:59:04.297", "references": [{"url": "http://www-01.ibm.com/support/docview.wss?uid=swg21985736", "tags": ["Vendor Advisory"], "source": "psirt@us.ibm.com"}, {"url": "http://www.securityfocus.com/bid/91689", "source": "psirt@us.ibm.com"}, {"url": "http://www.securitytracker.com/id/1036255", "source": "psirt@us.ibm.com"}, {"url": "http://www-01.ibm.com/support/docview.wss?uid=swg21985736", "tags": ["Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://www.securityfocus.com/bid/91689", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://www.securitytracker.com/id/1036255", "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-284"}]}], "descriptions": [{"lang": "en", "value": "IBM Security Identity Manager (ISIM) Virtual Appliance 7.0.0.0 through 7.0.1.1 before 7.0.1-ISS-SIM-FP0003 mishandles session identifiers after logout, which makes it easier for remote attackers to spoof users by leveraging knowledge of \"traffic records.\""}, {"lang": "es", "value": "IBM Security Identity Manager (ISIM) Virtual Appliance 7.0.0.0 hasta la versi\u00f3n 7.0.1.1 en versiones anteriores a 7.0.1-ISS-SIM-FP0003 maneja incorrectamente identificadores de sesi\u00f3n despu\u00e9s del cierre de sesi\u00f3n, lo que facilita a atacantes remotos suplantar usuarios aprovechando el conocimiento de \"traffic records\"."}], "lastModified": "2025-04-12T10:46:40.837", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:ibm:security_identity_manager_adapter:7.0.0.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "4F8FD871-0A5E-4413-8F1C-4125DA7741CB"}, {"criteria": "cpe:2.3:a:ibm:security_identity_manager_adapter:7.0.0.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "17761140-202D-46B4-A955-F20FB7E4202E"}, {"criteria": "cpe:2.3:a:ibm:security_identity_manager_adapter:7.0.0.2:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "9238298D-D05D-4E71-A824-36D50820482E"}, {"criteria": "cpe:2.3:a:ibm:security_identity_manager_adapter:7.0.0.3:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "CE2D15D2-AA55-4077-AD96-8E380FD326C5"}, {"criteria": "cpe:2.3:a:ibm:security_identity_manager_adapter:7.0.1.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "2FA93FE3-93FF-40E4-B8CC-F078310C1B81"}, {"criteria": "cpe:2.3:a:ibm:security_identity_manager_adapter:7.0.1.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "A2E94FC6-A188-4029-A855-AC9F4BC6539D"}], "operator": "OR"}]}], "sourceIdentifier": "psirt@us.ibm.com"}