Improper HSTS Implementation in IBM Security Guardium Database Activity Monitor
CVE-2016-0240
3.7LOW
Key Information:
- Vendor
- IBM
- Vendor
- CVE Published:
- 22 October 2016
Summary
IBM Security Guardium Database Activity Monitor versions prior to p310 in 8.2, p700 in 9.x, and p100 in 10.x lack proper implementation of the HTTP Strict Transport Security (HSTS) mechanism. This oversight allows remote attackers to exploit the absence of HSTS, enabling them to potentially intercept sensitive data transmitted over HTTP, thereby increasing the risk of data breaches and unauthorized access.
References
CVSS V3.1
Score:
3.7
Severity:
LOW
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged
Timeline
Vulnerability published
Vulnerability Reserved