CVE-2016-3025
IBM Security Access Manager for Mobile 8.x before 8.0.1.4 IF3 and Security Access Manager 9.x before 9.0.1.0 IF5 do not properly restrict failed login attempts, which makes it easier for remote attackers to obtain access via a brute-force approach.
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (1.60%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
IBM Security Access Manager for Mobile 8.x before 8.0.1.4 IF3 and Security Access Manager 9.x before 9.0.1.0 IF5 do not properly restrict failed login attempts, which makes it easier for remote attackers to obtain access via a brute-force approach.
- CVSS 3.0
- 8.1 HIGHCVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
- EPSS
- 1.60% probability · 74th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-254
- Affected
- ibm/security access manager · ibm/security access manager for mobile
- Source
- psirt@us.ibm.com
References
- http://www-01.ibm.com/support/docview.wss?uid=swg1IV89240Broken Link
- http://www-01.ibm.com/support/docview.wss?uid=swg1IV89258Broken Link
- http://www-01.ibm.com/support/docview.wss?uid=swg21991107Vendor Advisory
- http://www.securityfocus.com/bid/93178
- http://www-01.ibm.com/support/docview.wss?uid=swg1IV89240Broken Link
- http://www-01.ibm.com/support/docview.wss?uid=swg1IV89258Broken Link
- http://www-01.ibm.com/support/docview.wss?uid=swg21991107Vendor Advisory
- http://www.securityfocus.com/bid/93178
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.