CVEvulnerability

CVE-2016-9703

2.4 LOW Published 2017-02-01 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2017-02-01
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.0 ([email protected])
2.4 LOW — CVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
CVSS 2.0 ([email protected])
2.1 LOW — AV:L/AC:L/Au:N/C:P/I:N/A:N
Weaknesses
CWE-384

Description

IBM Security Identity Manager Virtual Appliance does not invalidate session tokens which could allow an unauthorized user with physical access to the work station to obtain sensitive information.

Affected configurations

• ibm security identity manager virtual appliance 7.0.0.0 • ibm security identity manager virtual appliance 7.0.0.1 • ibm security identity manager virtual appliance 7.0.0.2 • ibm security identity manager virtual appliance 7.0.0.3 • ibm security identity manager virtual appliance 7.0.1.0 • ibm security identity manager virtual appliance 7.0.1.1 • ibm security identity manager virtual appliance 7.0.1.2 • ibm security identity manager virtual appliance 7.0.1.3 • ibm security identity manager virtual appliance 7.0.1.4

Related

Weakness · CWE (1)

  • CWE-384 Session Fixation weakness

References