Medium severity · published Mar 27, 2017
CVE-2017-1143
IBM Kenexa LCMS Premier on Cloud 9.x and 10.0 could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable HTTP Strict Transport…
5.3
CVSS
0.9%
EPSS
No
On KEV
Description
IBM Kenexa LCMS Premier on Cloud 9.x and 10.0 could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable HTTP Strict Transport Security. An attacker could exploit this vulnerability to obtain sensitive information using man in the middle techniques. IBM Reference #: 1998874.
CVSS vector
CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
High
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.9% · higher than 60% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
KL
Kenexa LCMS Premier on Cloud · IBM Corporation
9.0; 9.1; 9.2; 9.2.1; 9.3.0; 9.4.0; +5 more · source: vendor
KL
Kenexa Lcms Premier · Ibm
9.1; 9.2; 9.2.1; 9.3; 9.4; 9.5; +3 more · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2017-1143
CVE.org
https://www.cve.org/CVERecord?id=CVE-2017-1143
Mitigation
http://www.ibm.com/support/docview.wss?uid=swg21998874
Third Party Advisory
http://www.securityfocus.com/bid/97079
More from Kenexa LCMS Premier on Cloud
8.8
CVE-2016-5937
IBM Kenexa LCMS Premier on Cloud is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user…
8.8
CVE-2016-5952
IBM Kenexa LCMS Premier on Cloud is vulnerable to SQL injection
7.1
CVE-2016-9993
IBM Kenexa LCMS Premier on Cloud 9.0, and 10.0.0 is vulnerable to SQL injection
7.1
CVE-2016-9994
IBM Kenexa LCMS Premier on Cloud 9.0, and 10.0.0 is vulnerable to SQL injection
7.1
CVE-2016-9992
IBM Kenexa LCMS Premier on Cloud 9.0, and 10.0.0 is vulnerable to SQL injection