VulnerabilityModified
CVE-2016-2953
IBM Connections 4.0 through CR4, 4.5 through CR5, and 5.0 before CR4 does not require SSL, which allows remote attackers to obtain sensitive cleartext information by sniffing the network.
LOW 3.7EPSS 1.27%
Does this matter?
Lower severity and a low EPSS score (1.27%). Track it; it rarely justifies an emergency change on its own.
Description
IBM Connections 4.0 through CR4, 4.5 through CR5, and 5.0 before CR4 does not require SSL, which allows remote attackers to obtain sensitive cleartext information by sniffing the network.
- CVSS 3.0
- 3.7 LOWCVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
- EPSS
- 1.27% probability · 68th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-310
- Affected
- ibm/connections
- Source
- psirt@us.ibm.com
References
- http://www-01.ibm.com/support/docview.wss?uid=swg1LO90268Broken Link
- http://www-01.ibm.com/support/docview.wss?uid=swg1LO90295Broken Link
- http://www-01.ibm.com/support/docview.wss?uid=swg21990888Patch, Vendor Advisory
- http://www.securityfocus.com/bid/94415Third Party Advisory, VDB Entry
- http://www-01.ibm.com/support/docview.wss?uid=swg1LO90268Broken Link
- http://www-01.ibm.com/support/docview.wss?uid=swg1LO90295Broken Link
- http://www-01.ibm.com/support/docview.wss?uid=swg21990888Patch, Vendor Advisory
- http://www.securityfocus.com/bid/94415Third Party Advisory, VDB Entry
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.