Unscored severity · published Jun 21, 2014
CVE-2014-3052
The reverse-proxy feature in IBM Security Access Manager (ISAM) for Web 8.0 with firmware 8.0.0.2 and 8.0.0.3 interprets the jct-nist-compliance parameter in the opposite of the…
–
CVSS
0.4%
EPSS
No
On KEV
Description
The reverse-proxy feature in IBM Security Access Manager (ISAM) for Web 8.0 with firmware 8.0.0.2 and 8.0.0.3 interprets the jct-nist-compliance parameter in the opposite of the intended manner, which makes it easier for remote attackers to obtain sensitive information by leveraging weak SSL encryption settings that lack NIST SP 800-131A compliance.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 30% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SA
Security Access Manager For Web 8.0 Firmware · Ibm
8.0.0.2; 8.0.0.3 · source: NVD
SA
Security Access Manager For Web Appliance · Ibm
8.0 · source: NVD
Affected product
SA
Security Access Manager For Web 8.0 Firmware
Ibm
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2014-3052
CVE.org
https://www.cve.org/CVERecord?id=CVE-2014-3052
www-01.ibm.com
http://www-01.ibm.com/support/docview.wss?uid=swg1IV61553
www-01.ibm.com
http://www-01.ibm.com/support/docview.wss?uid=swg21676705
exchange.xforce.ibmcloud.com
https://exchange.xforce.ibmcloud.com/vulnerabilities/93454
More from Security Access Manager For Web 8.0 Firmware
9.8
CVE-2014-7169
GNU Bourne-Again Shell (Bash) Arbitrary Code Execution Vulnerability
9.8
CVE-2014-6271
GNU Bourne-Again Shell (Bash) Arbitrary Code Execution Vulnerability
9.1
CVE-2016-2908
IBM Single Sign On for Bluemix could allow a remote attacker to obtain sensitive information, caused by a XML external entity (XXE) error when processing XML data by the XML…
8.8
CVE-2016-3029
IBM Security Access Manager for Web is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user…
8.0
CVE-2015-5018
IBM Security Access Manager for Web 7.0.0 before FP19 and 8.0 before 8.0.1.3 IF3, and Security Access Manager 9.0 before 9.0.0.0 IF1, allows remote authenticated users to execute…