Improper HSTS Implementation in IBM Security Guardium Database Activity Monitor
CVE-2016-0240

3.7LOW

Key Information:

Vendor
IBM
Vendor
CVE Published:
22 October 2016

Summary

IBM Security Guardium Database Activity Monitor versions prior to p310 in 8.2, p700 in 9.x, and p100 in 10.x lack proper implementation of the HTTP Strict Transport Security (HSTS) mechanism. This oversight allows remote attackers to exploit the absence of HSTS, enabling them to potentially intercept sensitive data transmitted over HTTP, thereby increasing the risk of data breaches and unauthorized access.

References

CVSS V3.1

Score:
3.7
Severity:
LOW
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.