Vulnerability Details : CVE-2016-0321
IBM Personal Communications (aka PCOMM) 6.x before 6.0.17 and 12.x before 12.0.0.1 does not properly restrict credential extraction, which allows local users to discover passwords by leveraging access to the victim account and executing a PowerShell script.
Products affected by CVE-2016-0321
- cpe:2.3:a:ibm:personal_communications:12.0.0:*:*:*:*:*:*:*
- cpe:2.3:a:ibm:personal_communications:6.0.16:*:*:*:*:*:*:*
- cpe:2.3:a:ibm:personal_communications:6.0.15:*:*:*:*:*:*:*
- cpe:2.3:a:ibm:personal_communications:6.0.8:*:*:*:*:*:*:*
- cpe:2.3:a:ibm:personal_communications:6.0.7:*:*:*:*:*:*:*
- cpe:2.3:a:ibm:personal_communications:6.0.6:*:*:*:*:*:*:*
- cpe:2.3:a:ibm:personal_communications:6.0.14:*:*:*:*:*:*:*
- cpe:2.3:a:ibm:personal_communications:6.0.13:*:*:*:*:*:*:*
- cpe:2.3:a:ibm:personal_communications:6.0.5:*:*:*:*:*:*:*
- cpe:2.3:a:ibm:personal_communications:6.0.4:*:*:*:*:*:*:*
- cpe:2.3:a:ibm:personal_communications:6.0.12:*:*:*:*:*:*:*
- cpe:2.3:a:ibm:personal_communications:6.0.11:*:*:*:*:*:*:*
- cpe:2.3:a:ibm:personal_communications:6.0.3:*:*:*:*:*:*:*
- cpe:2.3:a:ibm:personal_communications:6.0.2:*:*:*:*:*:*:*
- cpe:2.3:a:ibm:personal_communications:6.0.10:*:*:*:*:*:*:*
- cpe:2.3:a:ibm:personal_communications:6.0.9:*:*:*:*:*:*:*
- cpe:2.3:a:ibm:personal_communications:6.0.1:*:*:*:*:*:*:*
- cpe:2.3:a:ibm:personal_communications:6.0.0:*:*:*:*:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2016-0321
0.13%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 30 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2016-0321
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
2.1
|
LOW | AV:L/AC:L/Au:N/C:P/I:N/A:N |
3.9
|
2.9
|
NIST | |
|
6.2
|
MEDIUM | CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
2.5
|
3.6
|
NIST |
CWE ids for CVE-2016-0321
-
The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.Assigned by: nvd@nist.gov (Primary)
References for CVE-2016-0321
-
http://www-01.ibm.com/support/docview.wss?uid=swg1IT12006
IBM IT12006: PCOM: PCSNP.EXE PASSES USER NAME AND PASSWORD IN PLAIN TEXT
-
http://www-01.ibm.com/support/docview.wss?uid=swg21981692
IBM Security Bulletin: IBM Personal Communications could allow a remote user to obtain sensitive information including user passwords, allowing unauthorized access. (CVE-2016-0321)Vendor Advisory
-
http://www.securityfocus.com/bid/91751
IBM Personal Communications CVE-2016-0321 Information Disclosure Vulnerability
Jump to