CVE-2016-6116 : IBM Tivoli Key Lifecycle Manager 2.5 and 2.6 could allow a remote attacker to ob

IBM Tivoli Key Lifecycle Manager 2.5 and 2.6 could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable HTTP Strict Transport Security. An attacker could exploit this vulnerability to obtain sensitive information using man in the middle techniques.

Published 2017-02-02 22:59:00

Updated 2017-02-07 21:59:20

Source IBM Corporation

View at NVD, CVE.org

Vulnerability category: Information leak

Products affected by CVE-2016-6116

IBM » Security Key Lifecycle Manager » Version: 2.5.0.7
cpe:2.3:a:ibm:security_key_lifecycle_manager:2.5.0.7:*:*:*:*:*:*:*
Matching versions
IBM » Security Key Lifecycle Manager » Version: 2.5.0.6
cpe:2.3:a:ibm:security_key_lifecycle_manager:2.5.0.6:*:*:*:*:*:*:*
Matching versions
IBM » Security Key Lifecycle Manager » Version: 2.5.0.5
cpe:2.3:a:ibm:security_key_lifecycle_manager:2.5.0.5:*:*:*:*:*:*:*
Matching versions
IBM » Security Key Lifecycle Manager » Version: 2.6.0.1
cpe:2.3:a:ibm:security_key_lifecycle_manager:2.6.0.1:*:*:*:*:*:*:*
Matching versions
IBM » Security Key Lifecycle Manager » Version: 2.5.0.0
cpe:2.3:a:ibm:security_key_lifecycle_manager:2.5.0.0:*:*:*:*:*:*:*
Matching versions
IBM » Security Key Lifecycle Manager » Version: 2.5.0.3
cpe:2.3:a:ibm:security_key_lifecycle_manager:2.5.0.3:*:*:*:*:*:*:*
Matching versions
IBM » Security Key Lifecycle Manager » Version: 2.5.0.1
cpe:2.3:a:ibm:security_key_lifecycle_manager:2.5.0.1:*:*:*:*:*:*:*
Matching versions
IBM » Security Key Lifecycle Manager » Version: 2.5.0.4
cpe:2.3:a:ibm:security_key_lifecycle_manager:2.5.0.4:*:*:*:*:*:*:*
Matching versions
IBM » Security Key Lifecycle Manager » Version: 2.5.0.2
cpe:2.3:a:ibm:security_key_lifecycle_manager:2.5.0.2:*:*:*:*:*:*:*
Matching versions
IBM » Security Key Lifecycle Manager » Version: 2.6.0.2
cpe:2.3:a:ibm:security_key_lifecycle_manager:2.6.0.2:*:*:*:*:*:*:*
Matching versions
IBM » Security Key Lifecycle Manager » Version: 2.6.0
cpe:2.3:a:ibm:security_key_lifecycle_manager:2.6.0:*:*:*:*:*:*:*
Matching versions
IBM » Security Key Lifecycle Manager » Version: 2.5.0
cpe:2.3:a:ibm:security_key_lifecycle_manager:2.5.0:*:*:*:*:*:*:*
Matching versions

Exploit prediction scoring system (EPSS) score for CVE-2016-6116

EPSS FAQ

0.14%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 48 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2016-6116

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
4.3	MEDIUM	AV:N/AC:M/Au:N/C:P/I:N/A:N	8.6	2.9	NIST
Access Vector: Network Access Complexity: Medium Authentication: None Confidentiality Impact: Partial Integrity Impact: None Availability Impact: None
5.9	MEDIUM	CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N	2.2	3.6	NIST
Attack Vector: Network Attack Complexity: High Privileges Required: None User Interaction: None Scope: Unchanged Confidentiality: High Integrity: None Availability: None

CWE ids for CVE-2016-6116

CWE-200 Exposure of Sensitive Information to an Unauthorized Actor

The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

Assigned by: nvd@nist.gov (Primary)

References for CVE-2016-6116

http://www.securityfocus.com/bid/95966

IBM Security Key Lifecycle Manager CVE-2016-6116 Information Disclosure Vulnerability
Third Party Advisory;VDB Entry
http://www.ibm.com/support/docview.wss?uid=swg21997805

IBM Security Bulletin: IBM Security Key Lifecycle Manager is affected by exposure of sensitive data due to missing HTTP Strict-Transport-Security Header (CVE-2016-6116)
Patch;Vendor Advisory

Jump to

Vulnerability Details : CVE-2016-6116

Products affected by CVE-2016-6116

Exploit prediction scoring system (EPSS) score for CVE-2016-6116

CVSS scores for CVE-2016-6116

CWE ids for CVE-2016-6116

References for CVE-2016-6116