Improper HSTS Implementation in IBM Security Guardium Database Activity Monitor
CVE-2016-0240

3.7LOW

Key Information:

Vendor
IBM
Status
Security Guardium Database Activity Monitor
Vendor
CVE Published:
22 October 2016

Summary

IBM Security Guardium Database Activity Monitor versions prior to p310 in 8.2, p700 in 9.x, and p100 in 10.x lack proper implementation of the HTTP Strict Transport Security (HSTS) mechanism. This oversight allows remote attackers to exploit the absence of HSTS, enabling them to potentially intercept sensitive data transmitted over HTTP, thereby increasing the risk of data breaches and unauthorized access.

References

http://www-01.ibm.com/support/docview.wss?uid=swg21990232
x_refsource_CONFIRM
http://www.securityfocus.com/bid/93836
vdb-entryx_refsource_BID

CVSS V3.1

Score:
3.7
Severity:
LOW
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.