VulnerabilityModified
CVE-2016-0321
IBM Personal Communications (aka PCOMM) 6.x before 6.0.17 and 12.x before 12.0.0.1 does not properly restrict credential extraction, which allows local users to discover passwords by leveraging access to the victim account and executing a PowerShell…
MEDIUM 6.2EPSS 0.37%
Does this matter?
Lower severity and a low EPSS score (0.37%). Track it; it rarely justifies an emergency change on its own.
Description
IBM Personal Communications (aka PCOMM) 6.x before 6.0.17 and 12.x before 12.0.0.1 does not properly restrict credential extraction, which allows local users to discover passwords by leveraging access to the victim account and executing a PowerShell script.
- CVSS 3.0
- 6.2 MEDIUMCVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
- EPSS
- 0.37% probability · 31th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-200
- Affected
- ibm/personal communications
- Source
- psirt@us.ibm.com
References
- http://www-01.ibm.com/support/docview.wss?uid=swg1IT12006
- http://www-01.ibm.com/support/docview.wss?uid=swg21981692Vendor Advisory
- http://www.securityfocus.com/bid/91751
- http://www-01.ibm.com/support/docview.wss?uid=swg1IT12006
- http://www-01.ibm.com/support/docview.wss?uid=swg21981692Vendor Advisory
- http://www.securityfocus.com/bid/91751
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.