CVE-2016-5894 : IBM WebSphere Commerce Enterprise, Professional, Express, and Developer 7.0 and 8.0 is vulnerable to information disclos

IBM WebSphere Commerce Enterprise, Professional, Express, and Developer 7.0 and 8.0 is vulnerable to information disclosure vulnerability. A local user could view a plain text password in a Unix console. IBM Reference #: 1997408.

Published 2017-03-08 19:59:00

Updated 2019-09-30 16:19:44

Source IBM Corporation

View at NVD, CVE.org

Vulnerability category: Information leak

Exploit prediction scoring system (EPSS) score for CVE-2016-5894

EPSS FAQ

0.08%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 33 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2016-5894

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
1.9	LOW	AV:L/AC:M/Au:N/C:P/I:N/A:N	3.4	2.9	NIST
Access Vector: Local Access Complexity: Medium Authentication: None Confidentiality Impact: Partial Integrity Impact: None Availability Impact: None
5.1	MEDIUM	CVSS:3.0/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N	1.4	3.6	NIST
Attack Vector: Local Attack Complexity: High Privileges Required: None User Interaction: None Scope: Unchanged Confidentiality: High Integrity: None Availability: None

References for CVE-2016-5894

http://www.ibm.com/support/docview.wss?uid=swg21997408

IBM Security Bulletin: IBM WebSphere Commerce admin utilities could lead to disclosure of user personal data (CVE-2016-5894)
Patch;Vendor Advisory
http://www.securityfocus.com/bid/96624

IBM WebSphere Commerce CVE-2016-5894 Local Information Disclosure Vulnerability
http://www.securitytracker.com/id/1037962

IBM WebSphere Commerce Flaw in Administrative Utilities Lets Local Users Obtain Potentially Sensitive Information on the Target System - SecurityTracker

Products affected by CVE-2016-5894

IBM » Websphere Commerce » Version: 7.0
cpe:2.3:a:ibm:websphere_commerce:7.0:*:*:*:*:*:*:*
Matching versions
IBM » Websphere Commerce » Version: 7.0.0.1
cpe:2.3:a:ibm:websphere_commerce:7.0.0.1:*:*:*:*:*:*:*
Matching versions
IBM » Websphere Commerce » Version: 7.0.0.2
cpe:2.3:a:ibm:websphere_commerce:7.0.0.2:*:*:*:*:*:*:*
Matching versions
IBM » Websphere Commerce » Version: 7.0.0.3
cpe:2.3:a:ibm:websphere_commerce:7.0.0.3:*:*:*:*:*:*:*
Matching versions
IBM » Websphere Commerce » Version: 7.0.0.4
cpe:2.3:a:ibm:websphere_commerce:7.0.0.4:*:*:*:*:*:*:*
Matching versions
IBM » Websphere Commerce » Version: 7.0.0.5
cpe:2.3:a:ibm:websphere_commerce:7.0.0.5:*:*:*:*:*:*:*
Matching versions
IBM » Websphere Commerce » Version: 7.0.0.6
cpe:2.3:a:ibm:websphere_commerce:7.0.0.6:*:*:*:*:*:*:*
Matching versions
IBM » Websphere Commerce » Version: 7.0.0.7
cpe:2.3:a:ibm:websphere_commerce:7.0.0.7:*:*:*:*:*:*:*
Matching versions
IBM » Websphere Commerce » Version: 7.0.0.8
cpe:2.3:a:ibm:websphere_commerce:7.0.0.8:*:*:*:*:*:*:*
Matching versions
IBM » Websphere Commerce » Version: 7.0.0.9
cpe:2.3:a:ibm:websphere_commerce:7.0.0.9:*:*:*:*:*:*:*
Matching versions
IBM » Websphere Commerce » Version: 8.0.0.0
cpe:2.3:a:ibm:websphere_commerce:8.0.0.0:*:*:*:*:*:*:*
Matching versions
IBM » Websphere Commerce » Version: 8.0.0.2
cpe:2.3:a:ibm:websphere_commerce:8.0.0.2:*:*:*:*:*:*:*
Matching versions
IBM » Websphere Commerce » Version: 8.0.0.1
cpe:2.3:a:ibm:websphere_commerce:8.0.0.1:*:*:*:*:*:*:*
Matching versions
IBM » Websphere Commerce » Version: 8.0.0.8
cpe:2.3:a:ibm:websphere_commerce:8.0.0.8:*:*:*:*:*:*:*
Matching versions
IBM » Websphere Commerce » Version: 8.0.0.6
cpe:2.3:a:ibm:websphere_commerce:8.0.0.6:*:*:*:*:*:*:*
Matching versions
IBM » Websphere Commerce » Version: 8.0.0.3
cpe:2.3:a:ibm:websphere_commerce:8.0.0.3:*:*:*:*:*:*:*
Matching versions
IBM » Websphere Commerce » Version: 8.0.0.9
cpe:2.3:a:ibm:websphere_commerce:8.0.0.9:*:*:*:*:*:*:*
Matching versions
IBM » Websphere Commerce » Version: 8.0.0.7
cpe:2.3:a:ibm:websphere_commerce:8.0.0.7:*:*:*:*:*:*:*
Matching versions
IBM » Websphere Commerce » Version: 8.0.0.5
cpe:2.3:a:ibm:websphere_commerce:8.0.0.5:*:*:*:*:*:*:*
Matching versions
IBM » Websphere Commerce » Version: 8.0.0.4
cpe:2.3:a:ibm:websphere_commerce:8.0.0.4:*:*:*:*:*:*:*
Matching versions
IBM » Websphere Commerce » Version: 8.0.1.0
cpe:2.3:a:ibm:websphere_commerce:8.0.1.0:*:*:*:*:*:*:*
Matching versions
IBM » Websphere Commerce » Version: 8.0.1.1
cpe:2.3:a:ibm:websphere_commerce:8.0.1.1:*:*:*:*:*:*:*
Matching versions
IBM » Websphere Commerce » Version: 8.0.1.8
cpe:2.3:a:ibm:websphere_commerce:8.0.1.8:*:*:*:*:*:*:*
Matching versions
IBM » Websphere Commerce » Version: 8.0.1.9
cpe:2.3:a:ibm:websphere_commerce:8.0.1.9:*:*:*:*:*:*:*
Matching versions
IBM » Websphere Commerce » Version: 8.0.0.10
cpe:2.3:a:ibm:websphere_commerce:8.0.0.10:*:*:*:*:*:*:*
Matching versions
IBM » Websphere Commerce » Version: 8.0.0.17
cpe:2.3:a:ibm:websphere_commerce:8.0.0.17:*:*:*:*:*:*:*
Matching versions
IBM » Websphere Commerce » Version: 8.0.0.18
cpe:2.3:a:ibm:websphere_commerce:8.0.0.18:*:*:*:*:*:*:*
Matching versions
IBM » Websphere Commerce » Version: 8.0.1.2
cpe:2.3:a:ibm:websphere_commerce:8.0.1.2:*:*:*:*:*:*:*
Matching versions
IBM » Websphere Commerce » Version: 8.0.1.3
cpe:2.3:a:ibm:websphere_commerce:8.0.1.3:*:*:*:*:*:*:*
Matching versions
IBM » Websphere Commerce » Version: 8.0.1.11
cpe:2.3:a:ibm:websphere_commerce:8.0.1.11:*:*:*:*:*:*:*
Matching versions
IBM » Websphere Commerce » Version: 8.0.1.12
cpe:2.3:a:ibm:websphere_commerce:8.0.1.12:*:*:*:*:*:*:*
Matching versions
IBM » Websphere Commerce » Version: 8.0.0.11
cpe:2.3:a:ibm:websphere_commerce:8.0.0.11:*:*:*:*:*:*:*
Matching versions
IBM » Websphere Commerce » Version: 8.0.0.12
cpe:2.3:a:ibm:websphere_commerce:8.0.0.12:*:*:*:*:*:*:*
Matching versions
IBM » Websphere Commerce » Version: 8.0.0.19
cpe:2.3:a:ibm:websphere_commerce:8.0.0.19:*:*:*:*:*:*:*
Matching versions
IBM » Websphere Commerce » Version: 8.0.1.6
cpe:2.3:a:ibm:websphere_commerce:8.0.1.6:*:*:*:*:*:*:*
Matching versions
IBM » Websphere Commerce » Version: 8.0.1.7
cpe:2.3:a:ibm:websphere_commerce:8.0.1.7:*:*:*:*:*:*:*
Matching versions
IBM » Websphere Commerce » Version: 8.0.0.15
cpe:2.3:a:ibm:websphere_commerce:8.0.0.15:*:*:*:*:*:*:*
Matching versions
IBM » Websphere Commerce » Version: 8.0.0.16
cpe:2.3:a:ibm:websphere_commerce:8.0.0.16:*:*:*:*:*:*:*
Matching versions
IBM » Websphere Commerce » Version: 8.0.1.4
cpe:2.3:a:ibm:websphere_commerce:8.0.1.4:*:*:*:*:*:*:*
Matching versions
IBM » Websphere Commerce » Version: 8.0.1.5
cpe:2.3:a:ibm:websphere_commerce:8.0.1.5:*:*:*:*:*:*:*
Matching versions
IBM » Websphere Commerce » Version: 8.0.0.13
cpe:2.3:a:ibm:websphere_commerce:8.0.0.13:*:*:*:*:*:*:*
Matching versions
IBM » Websphere Commerce » Version: 8.0.0.14
cpe:2.3:a:ibm:websphere_commerce:8.0.0.14:*:*:*:*:*:*:*
Matching versions

Vulnerability Details : CVE-2016-5894

Exploit prediction scoring system (EPSS) score for CVE-2016-5894

CVSS scores for CVE-2016-5894

CWE ids for CVE-2016-5894

References for CVE-2016-5894

Products affected by CVE-2016-5894