Details of VAR-201602-0386

ID

VAR-201602-0386

CVE

CVE-2015-5010

TITLE

IBM Security Access Manager for Web and Security Access Manager Vulnerabilities that gain access

Trust: 0.8

sources: JVNDB: JVNDB-2015-006975

DESCRIPTION

IBM Security Access Manager for Web 7.0 before 7.0.0 IF21, 8.0 before 8.0.1.3 IF4, and 9.0 before 9.0.0.1 IF1 does not have a lockout mechanism for invalid login attempts, which makes it easier for remote attackers to obtain access via a brute-force attack. Supplementary information : CWE Vulnerability type by CWE-254: Security Features ( Security function ) Has been identified. http://cwe.mitre.org/data/definitions/254.htmlRound robin by a third party (brute-force) Access may be gained through an attack. An attacker can exploit this issue to gain access to sensitive information; this may lead to further attacks. It provides user access management and Web application protection function. There is a security hole in ISAM for Web, which is caused by the fact that the program does not set a locking mechanism for invalid login requests. The following versions are affected: ISAM for Web Version 7.0, Version 8.0, Version 9.0

Trust: 1.98

sources: NVD: CVE-2015-5010 // JVNDB: JVNDB-2015-006975 // BID: 85208 // VULHUB: VHN-82971

AFFECTED PRODUCTS

vendor:	ibm	model:	security access manager for web 8.0	scope:	eq	version:	8.0.0.2	Trust: 1.6
vendor:	ibm	model:	security access manager for web 8.0	scope:	eq	version:	8.0.0.3	Trust: 1.6
vendor:	ibm	model:	security access manager for web 8.0	scope:	eq	version:	8.0.1.3	Trust: 1.6
vendor:	ibm	model:	security access manager for web 8.0	scope:	eq	version:	8.0.1.2	Trust: 1.6
vendor:	ibm	model:	security access manager for web 8.0	scope:	eq	version:	8.0.0.5	Trust: 1.6
vendor:	ibm	model:	security access manager for web 7.0	scope:	eq	version:	7.0.0.1	Trust: 1.6
vendor:	ibm	model:	security access manager 9.0	scope:	eq	version:	9.0.0	Trust: 1.6
vendor:	ibm	model:	security access manager for web 8.0	scope:	eq	version:	8.0.1.0	Trust: 1.6
vendor:	ibm	model:	security access manager for web 8.0	scope:	eq	version:	8.0.1	Trust: 1.6
vendor:	ibm	model:	security access manager for web 8.0	scope:	eq	version:	8.0.0.1	Trust: 1.6
vendor:	ibm	model:	security access manager for web 7.0	scope:	eq	version:	7.0.0.12	Trust: 1.0
vendor:	ibm	model:	security access manager for web 7.0	scope:	eq	version:	7.0.0.14	Trust: 1.0
vendor:	ibm	model:	security access manager for web 7.0	scope:	eq	version:	7.0.0.6	Trust: 1.0
vendor:	ibm	model:	security access manager for web 7.0	scope:	eq	version:	7.0.0.16	Trust: 1.0
vendor:	ibm	model:	security access manager for web 7.0	scope:	eq	version:	7.0.0.18	Trust: 1.0
vendor:	ibm	model:	security access manager for web 7.0	scope:	eq	version:	7.0.0.3	Trust: 1.0
vendor:	ibm	model:	security access manager for web 7.0	scope:	eq	version:	7.0.0.15	Trust: 1.0
vendor:	ibm	model:	security access manager for web 7.0	scope:	eq	version:	7.0.0.13	Trust: 1.0
vendor:	ibm	model:	security access manager for web 7.0	scope:	eq	version:	7.0.0.17	Trust: 1.0
vendor:	ibm	model:	security access manager for web 7.0	scope:	eq	version:	7.0.0.7	Trust: 1.0
vendor:	ibm	model:	security access manager for web 7.0	scope:	eq	version:	7.0.0.8	Trust: 1.0
vendor:	ibm	model:	security access manager for web 7.0	scope:	eq	version:	7.0.0.20	Trust: 1.0
vendor:	ibm	model:	security access manager for web 7.0	scope:	eq	version:	7.0.0.11	Trust: 1.0
vendor:	ibm	model:	security access manager for web 7.0	scope:	eq	version:	7.0.0.4	Trust: 1.0
vendor:	ibm	model:	security access manager for web 7.0	scope:	eq	version:	7.0.0.5	Trust: 1.0
vendor:	ibm	model:	security access manager for web 7.0	scope:	eq	version:	7.0.0.2	Trust: 1.0
vendor:	ibm	model:	security access manager for web 7.0	scope:	eq	version:	7.0.0.10	Trust: 1.0
vendor:	ibm	model:	security access manager for web 7.0	scope:	eq	version:	7.0.0.19	Trust: 1.0
vendor:	ibm	model:	security access manager for web 7.0	scope:	eq	version:	7.0.0.9	Trust: 1.0
vendor:	ibm	model:	security access manager for web software	scope:	eq	version:	8.0.1.3 if4	Trust: 0.8
vendor:	ibm	model:	security access manager for web software	scope:	lt	version:	8.0	Trust: 0.8
vendor:	ibm	model:	security access manager software	scope:	eq	version:	9.0.0.1 if1	Trust: 0.8
vendor:	ibm	model:	security access manager for web software	scope:	eq	version:	7.0.0 if21	Trust: 0.8
vendor:	ibm	model:	security access manager software	scope:	lt	version:	9.0	Trust: 0.8
vendor:	ibm	model:	security access manager for web software	scope:	lt	version:	7.0	Trust: 0.8

sources: JVNDB: JVNDB-2015-006975 // CNNVD: CNNVD-201602-276 // NVD: CVE-2015-5010

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov:	CVE-2015-5010
value:	HIGH
Trust: 1.0
NVD:	CVE-2015-5010
value:	MEDIUM
Trust: 0.8
CNNVD:	CNNVD-201602-276
value:	MEDIUM
Trust: 0.6
VULHUB:	VHN-82971
value:	MEDIUM
Trust: 0.1

nvd@nist.gov:	CVE-2015-5010
severity:	MEDIUM
baseScore:	5.0
vectorString:	AV:N/AC:L/AU:N/C:P/I:N/A:N
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	PARTIAL
integrityImpact:	NONE
availabilityImpact:	NONE
exploitabilityScore:	10.0
impactScore:	2.9
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 1.8
VULHUB:	VHN-82971
severity:	MEDIUM
baseScore:	5.0
vectorString:	AV:N/AC:L/AU:N/C:P/I:N/A:N
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	PARTIAL
integrityImpact:	NONE
availabilityImpact:	NONE
exploitabilityScore:	10.0
impactScore:	2.9
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.1

nvd@nist.gov:	CVE-2015-5010
baseSeverity:	HIGH
baseScore:	7.5
vectorString:	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
attackVector:	NETWORK
attackComplexity:	LOW
privilegesRequired:	NONE
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	HIGH
integrityImpact:	NONE
availabilityImpact:	NONE
exploitabilityScore:	3.9
impactScore:	3.6
version:	3.0
Trust: 1.0

sources: VULHUB: VHN-82971 // JVNDB: JVNDB-2015-006975 // CNNVD: CNNVD-201602-276 // NVD: CVE-2015-5010

PROBLEMTYPE DATA

problemtype:	CWE-254	Trust: 1.1
problemtype:	CWE-Other	Trust: 0.8

sources: VULHUB: VHN-82971 // JVNDB: JVNDB-2015-006975 // NVD: CVE-2015-5010

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-201602-276

TYPE

permissions and access control

Trust: 0.6

sources: CNNVD: CNNVD-201602-276

CONFIGURATIONS

sources: JVNDB: JVNDB-2015-006975

PATCH

title:	1970508	url:	http://www-01.ibm.com/support/docview.wss?uid=swg21970508	Trust: 0.8
title:	IBM Security Access Manager for Web Security vulnerabilities	url:	http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=60217	Trust: 0.6

sources: JVNDB: JVNDB-2015-006975 // CNNVD: CNNVD-201602-276

EXTERNAL IDS

db:	NVD	id:	CVE-2015-5010	Trust: 2.8
db:	JVNDB	id:	JVNDB-2015-006975	Trust: 0.8
db:	CNNVD	id:	CNNVD-201602-276	Trust: 0.7
db:	BID	id:	85208	Trust: 0.4
db:	VULHUB	id:	VHN-82971	Trust: 0.1

sources: VULHUB: VHN-82971 // BID: 85208 // JVNDB: JVNDB-2015-006975 // CNNVD: CNNVD-201602-276 // NVD: CVE-2015-5010

REFERENCES

url:	http://www-01.ibm.com/support/docview.wss?uid=swg21970508	Trust: 2.0
url:	http://www-01.ibm.com/support/docview.wss?uid=swg1iv80694	Trust: 1.7
url:	http://www-01.ibm.com/support/docview.wss?uid=swg1iv80728	Trust: 1.7
url:	http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2015-5010	Trust: 0.8
url:	http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2015-5010	Trust: 0.8
url:	http://www.ibm.com/	Trust: 0.3

sources: VULHUB: VHN-82971 // BID: 85208 // JVNDB: JVNDB-2015-006975 // CNNVD: CNNVD-201602-276 // NVD: CVE-2015-5010

CREDITS

IBM X-Force Ethical Hacking Team: Paul Ionescu, Warren Moynihan, Jonathan Fitz-Gerald, John Zuccato, Chris Shepherd. Dmitriy Beryoza

Trust: 0.3

sources: BID: 85208

SOURCES

db:	VULHUB	id:	VHN-82971
db:	BID	id:	85208
db:	JVNDB	id:	JVNDB-2015-006975
db:	CNNVD	id:	CNNVD-201602-276
db:	NVD	id:	CVE-2015-5010

LAST UPDATE DATE

2024-11-23T22:42:21.506000+00:00

SOURCES UPDATE DATE

db:	VULHUB	id:	VHN-82971	date:	2016-03-10T00:00:00
db:	BID	id:	85208	date:	2016-03-23T00:00:00
db:	JVNDB	id:	JVNDB-2015-006975	date:	2016-03-11T00:00:00
db:	CNNVD	id:	CNNVD-201602-276	date:	2016-02-16T00:00:00
db:	NVD	id:	CVE-2015-5010	date:	2024-11-21T02:32:10.317

SOURCES RELEASE DATE

db:	VULHUB	id:	VHN-82971	date:	2016-02-15T00:00:00
db:	BID	id:	85208	date:	2016-03-23T00:00:00
db:	JVNDB	id:	JVNDB-2015-006975	date:	2016-03-11T00:00:00
db:	CNNVD	id:	CNNVD-201602-276	date:	2016-02-16T00:00:00
db:	NVD	id:	CVE-2015-5010	date:	2016-02-15T02:59:05.637