CVE-2014-4806

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2014-4806
The installation process in IBM Security AppScan Enterprise 8.x before 8.6.0.2 iFix 003, 8.7.x before 8.7.0.1 iFix 003, 8.8.x before 8.8.0.1 iFix 002, and 9.0.x before 9.0.0.1 iFix 001 on Linux places a cleartext password in a temporary file, which allows local users to obtain sensitive information by reading this file.

5.5 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

2.1 /10

CVSS v2.0 : LOW

V2 Legend

Vector : AV:L/AC:L/Au:N/C:P/I:N/A:N

Exploitability : 3.9 / Impact : 2.9

Access Vector LOCAL

Access Complexity LOW

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact NONE

Availability Impact NONE

References
Link Resource
http://www-01.ibm.com/support/docview.wss?uid=swg21682642 Broken Link
http://www.securityfocus.com/bid/69435 Third Party Advisory VDB Entry
https://exchange.xforce.ibmcloud.com/vulnerabilities/95354 VDB Entry Vendor Advisory
Configurations

Configuration 1 (hide)

AND
OR cpe:2.3:a:ibm:security_appscan:*:*:*:*:enterprise:*:*:*
cpe:2.3:a:ibm:security_appscan:*:*:*:*:enterprise:*:*:*
cpe:2.3:a:ibm:security_appscan:*:*:*:*:enterprise:*:*:*
cpe:2.3:a:ibm:security_appscan:*:*:*:*:enterprise:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
History

11 Jun 2021, 14:47

Type Values Removed Values Added
CWE CWE-310 CWE-522
CVSS v2 : 2.1
v3 : unknown 		v2 : 2.1
v3 : 5.5
References (CONFIRM) http://www-01.ibm.com/support/docview.wss?uid=swg21682642 - Vendor Advisory (CONFIRM) http://www-01.ibm.com/support/docview.wss?uid=swg21682642 - Broken Link
References (XF) https://exchange.xforce.ibmcloud.com/vulnerabilities/95354 - (XF) https://exchange.xforce.ibmcloud.com/vulnerabilities/95354 - VDB Entry, Vendor Advisory
References (BID) http://www.securityfocus.com/bid/69435 - (BID) http://www.securityfocus.com/bid/69435 - Third Party Advisory, VDB Entry
CPE cpe:2.3:a:ibm:security_appscan:8.0.0.0:-:enterprise:*:*:*:*:*
cpe:2.3:a:ibm:security_appscan:8.0.1.0:-:enterprise:*:*:*:*:*
cpe:2.3:a:ibm:security_appscan:8.0.11:-:enterprise:*:*:*:*:*
cpe:2.3:a:ibm:security_appscan:8.0.0.1:-:enterprise:*:*:*:*:*
cpe:2.3:a:ibm:security_appscan:8.5.0.1:-:enterprise:*:*:*:*:*
cpe:2.3:a:ibm:security_appscan:8.6.0.1:-:enterprise:*:*:*:*:*
cpe:2.3:a:ibm:security_appscan:9.0.0.0:*:*:*:*:*:*:*
cpe:2.3:a:ibm:security_appscan:8.5.0.0:-:enterprise:*:*:*:*:*
cpe:2.3:a:ibm:security_appscan:8.6.0.0:-:enterprise:*:*:*:*:*
cpe:2.3:a:ibm:security_appscan:8.8.0.1:-:enterprise:*:*:*:*:*
cpe:2.3:a:ibm:security_appscan:8.7.0.0:-:enterprise:*:*:*:*:*
cpe:2.3:a:ibm:security_appscan:8.8.0.0:-:enterprise:*:*:*:*:*
cpe:2.3:a:ibm:security_appscan:8.7.0.1:-:enterprise:*:*:*:*:*
cpe:2.3:a:ibm:security_appscan:8.0.0.2:-:enterprise:*:*:*:*:*
cpe:2.3:a:ibm:security_appscan:8.0.1.1:-:enterprise:*:*:*:*:*
cpe:2.3:a:ibm:security_appscan:9.0.0.1:-:enterprise:*:*:*:*:*
cpe:2.3:a:ibm:security_appscan:8.6.0.2:-:enterprise:*:*:*:*:*		 cpe:2.3:a:ibm:security_appscan:*:*:*:*:enterprise:*:*:*

08 Jun 2021, 13:28

Type Values Removed Values Added
CPE cpe:2.3:a:ibm:security_appscan:9.0.0.0:-:enterprise:*:*:*:*:* cpe:2.3:a:ibm:security_appscan:9.0.0.0:*:*:*:*:*:*:*
Information

Published : 2014-08-29 09:55

Updated : 2024-02-04 18:35

NVD link : CVE-2014-4806

Mitre link : CVE-2014-4806

CVE.ORG link : CVE-2014-4806

JSON object : View

Products Affected

ibm

  • security_appscan

linux

  • linux_kernel
CWE
CWE-522

Insufficiently Protected Credentials