CVE-2014-3089
The RDS Java Client library in IBM Rational Directory Server (RDS) 5.1.1.x before 5.1.1.2 iFix004 and 5.2.x before 5.2.1 iFix003, and Rational Directory Administrator (RDA) 6.0 before iFix002, includes the cleartext root password, which allows local…
Does this matter?
Lower severity and a low EPSS score (0.38%). Track it; it rarely justifies an emergency change on its own.
Description
The RDS Java Client library in IBM Rational Directory Server (RDS) 5.1.1.x before 5.1.1.2 iFix004 and 5.2.x before 5.2.1 iFix003, and Rational Directory Administrator (RDA) 6.0 before iFix002, includes the cleartext root password, which allows local users to obtain sensitive information by reading a library file.
- CVSS 2.0
- 4.9 MEDIUMAV:L/AC:L/Au:N/C:C/I:N/A:N
- EPSS
- 0.38% probability · 31th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-310
- Affected
- ibm/rational directory administrator · ibm/rational directory server
- Source
- psirt@us.ibm.com
References
- http://www-01.ibm.com/support/docview.wss?uid=swg21681554Vendor Advisory
- http://www.securityfocus.com/bid/69300
- https://exchange.xforce.ibmcloud.com/vulnerabilities/94255
- http://www-01.ibm.com/support/docview.wss?uid=swg21681554Vendor Advisory
- http://www.securityfocus.com/bid/69300
- https://exchange.xforce.ibmcloud.com/vulnerabilities/94255
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.