CVE-2018-1454 : IBM InfoSphere Information Server 11.3, 11.5, and 11.7 could allow a remote atta

IBM InfoSphere Information Server 11.3, 11.5, and 11.7 could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable HTTP Strict Transport Security. An attacker could exploit this vulnerability to obtain sensitive information using man in the middle techniques. IBM X-Force ID: 140089.

Published 2018-06-05 15:29:00

Updated 2020-08-24 17:37:01

Source IBM Corporation

View at NVD, CVE.org

Products affected by CVE-2018-1454

IBM » Infosphere Information Server » Version: 11.3
cpe:2.3:a:ibm:infosphere_information_server:11.3:*:*:*:*:*:*:*
Matching versions
IBM » Infosphere Information Server » Version: 11.5
cpe:2.3:a:ibm:infosphere_information_server:11.5:*:*:*:*:*:*:*
Matching versions
IBM » Infosphere Information Server » Version: 11.7
cpe:2.3:a:ibm:infosphere_information_server:11.7:*:*:*:*:*:*:*
Matching versions

Exploit prediction scoring system (EPSS) score for CVE-2018-1454

EPSS FAQ

0.11%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 43 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2018-1454

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
4.3	MEDIUM	AV:N/AC:M/Au:N/C:P/I:N/A:N	8.6	2.9	NIST
Access Vector: Network Access Complexity: Medium Authentication: None Confidentiality Impact: Partial Integrity Impact: None Availability Impact: None
5.9	MEDIUM	CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N	2.2	3.6	NIST
Attack Vector: Network Attack Complexity: High Privileges Required: None User Interaction: None Scope: Unchanged Confidentiality: High Integrity: None Availability: None
5.9	MEDIUM	CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N	2.2	3.6	IBM Corporation
Attack Vector: Network Attack Complexity: High Privileges Required: None User Interaction: None Scope: Unchanged Confidentiality: High Integrity: None Availability: None

CWE ids for CVE-2018-1454

CWE-319 Cleartext Transmission of Sensitive Information

The product transmits sensitive or security-critical data in cleartext in a communication channel that can be sniffed by unauthorized actors.

Assigned by: nvd@nist.gov (Primary)

References for CVE-2018-1454

http://www.ibm.com/support/docview.wss?uid=swg22015222

IBM Security Bulletin: A vulnerability in IBM InfoSphere Information Server allows a remote attacker to obtain sensitive information (CVE-2018-1454)
Vendor Advisory
http://www.securitytracker.com/id/1041038

IBM InfoSphere Information Server HTTP STS Flaw Lets Remote Users Obtain Potentially Sensitive Information on the Target System - SecurityTracker
Third Party Advisory;VDB Entry
https://exchange.xforce.ibmcloud.com/vulnerabilities/140089

IBM InfoSphere Information Server information disclosure CVE-2018-1454 Vulnerability Report
Third Party Advisory;VDB Entry

Jump to

Vulnerability Details : CVE-2018-1454

Products affected by CVE-2018-1454

Exploit prediction scoring system (EPSS) score for CVE-2018-1454

CVSS scores for CVE-2018-1454

CWE ids for CVE-2018-1454

References for CVE-2018-1454