CVE-2016-5953

IBM Sterling Order Management transmits the session identifier within the URL. When a user is unable to view a certain view due to not being allowed permissions, the website responds with an error page where the session identifier is encoded as Base64 in the URL.

CVSS v3 3.7 LOW
CVSS v2.0 4.3 MEDIUM

3.7^/10

CVSS v3 : LOW

Vector : AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

Exploitability : 2.2 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required NONE

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

4.3^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:M/Au:N/C:P/I:N/A:N

Exploitability : 8.6 / Impact : 2.9

Access Vector NETWORK

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact NONE

Availability Impact NONE

References

Link	Resource
http://www.ibm.com/support/docview.wss?uid=swg21994521	Patch Vendor Advisory
http://www.securityfocus.com/bid/95431	Third Party Advisory VDB Entry

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:ibm:sterling_selling_and_fulfillment_foundation:9.1.0:::::::*
	cpe:2.3:a:ibm:sterling_selling_and_fulfillment_foundation:9.2.0:::::::*
	cpe:2.3:a:ibm:sterling_selling_and_fulfillment_foundation:9.2.1:::::::*
	cpe:2.3:a:ibm:sterling_selling_and_fulfillment_foundation:9.3:::::::*
	cpe:2.3:a:ibm:sterling_selling_and_fulfillment_foundation:9.4:::::::*
	cpe:2.3:a:ibm:sterling_selling_and_fulfillment_foundation:9.5:::::::*

History

No history.

Information

Published : 2017-02-01 22:59

Updated : 2023-12-10 12:01

NVD link : CVE-2016-5953

Mitre link : CVE-2016-5953

CVE.ORG link : CVE-2016-5953

JSON object : View

Products Affected

ibm

sterling_selling_and_fulfillment_foundation

CWE

CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

{"id": "CVE-2016-5953", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 4.3, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:N/C:P/I:N/A:N", "authentication": "NONE", "integrityImpact": "NONE", "accessComplexity": "MEDIUM", "availabilityImpact": "NONE", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.6, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV30": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.0", "baseScore": 3.7, "attackVector": "NETWORK", "baseSeverity": "LOW", "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 2.2}]}, "published": "2017-02-01T22:59:00.573", "references": [{"url": "http://www.ibm.com/support/docview.wss?uid=swg21994521", "tags": ["Patch", "Vendor Advisory"], "source": "psirt@us.ibm.com"}, {"url": "http://www.securityfocus.com/bid/95431", "tags": ["Third Party Advisory", "VDB Entry"], "source": "psirt@us.ibm.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-200"}]}], "descriptions": [{"lang": "en", "value": "IBM Sterling Order Management transmits the session identifier within the URL. When a user is unable to view a certain view due to not being allowed permissions, the website responds with an error page where the session identifier is encoded as Base64 in the URL."}, {"lang": "es", "value": "IBM Sterling Order Management transmite el identificador de sesi\u00f3n dentro de la URL. Cuando un usuario no puede ver una determinada vista debido a que no se autorizan permisos, el sitio web responde con una p\u00e1gina de error en la que el identificador de sesi\u00f3n se codifica como Base64 en la direcci\u00f3n URL."}], "lastModified": "2017-02-15T15:31:22.250", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:ibm:sterling_selling_and_fulfillment_foundation:9.1.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "843E8EC3-1965-48FE-8FB9-A6A08BDD4C67"}, {"criteria": "cpe:2.3:a:ibm:sterling_selling_and_fulfillment_foundation:9.2.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "5F5029B7-9CE0-44B2-A12D-6D51A04B1C4A"}, {"criteria": "cpe:2.3:a:ibm:sterling_selling_and_fulfillment_foundation:9.2.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "01C65391-6BEB-437B-ADE2-A55D96309384"}, {"criteria": "cpe:2.3:a:ibm:sterling_selling_and_fulfillment_foundation:9.3:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "10A09606-CB52-4494-A9E5-D983DEBD54C1"}, {"criteria": "cpe:2.3:a:ibm:sterling_selling_and_fulfillment_foundation:9.4:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "C1CCE857-1D23-4F0E-AC7C-FD7B45913846"}, {"criteria": "cpe:2.3:a:ibm:sterling_selling_and_fulfillment_foundation:9.5:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "443A72B2-E1F9-4069-8763-70F26498A058"}], "operator": "OR"}]}], "sourceIdentifier": "psirt@us.ibm.com"}