« Volver al listado

CVE-2014-4749

Estado: ModificadaMedia (4.3)—

IBM PowerVC 1.2.0 before FixPack3 does not properly use the known_hosts file, which allows man-in-the-middle attackers to spoof SSH servers via an arbitrary server key.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

IBM — Powervc

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2014-4749",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 4.3,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:M/Au:N/C:P/I:N/A:N",
          "authentication": "NONE",
          "integrityImpact": "NONE",
          "accessComplexity": "MEDIUM",
          "availabilityImpact": "NONE",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 2.9,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 8.6,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ]
  },
  "affected": [
    {
      "source": "psirt@us.ibm.com",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2014-08-20T11:17:14.720",
  "references": [
    {
      "url": "http://www-01.ibm.com/support/docview.wss?uid=nas8N1020224",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "psirt@us.ibm.com"
    },
    {
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/94351",
      "source": "psirt@us.ibm.com"
    },
    {
      "url": "http://www-01.ibm.com/support/docview.wss?uid=nas8N1020224",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/94351",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-264"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "IBM PowerVC 1.2.0 before FixPack3 does not properly use the known_hosts file, which allows man-in-the-middle attackers to spoof SSH servers via an arbitrary server key."
    },
    {
      "lang": "es",
      "value": "IBM PowerVC 1.2.0 anterior a FixPack3 no utiliza debidamente el fichero known_hosts, lo que permite a atacantes man-in-the-middle falsificar servidores SSH a través de una clave de servidor arbitraria."
    }
  ],
  "lastModified": "2026-06-17T00:10:32.747",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:ibm:powervc:1.2.0.0:*:*:*:express:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "F235BE09-8C8A-47DB-8FEB-1DB75B033143"
            },
            {
              "criteria": "cpe:2.3:a:ibm:powervc:1.2.0.0:*:*:*:standard:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "588EBB92-23C4-425B-9093-F776323B05F3"
            },
            {
              "criteria": "cpe:2.3:a:ibm:powervc:1.2.0.1:*:*:*:express:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "603F587A-2B4B-4FCD-B0AD-EE07553CB485"
            },
            {
              "criteria": "cpe:2.3:a:ibm:powervc:1.2.0.1:*:*:*:standard:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "AB78B5FF-E4F3-483D-A3BF-F2E2ED997DEF"
            },
            {
              "criteria": "cpe:2.3:a:ibm:powervc:1.2.0.2:*:*:*:express:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "68534B6C-B5EC-4F62-AF41-DDCE3C10ACBD"
            },
            {
              "criteria": "cpe:2.3:a:ibm:powervc:1.2.0.2:*:*:*:standard:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "C1626D53-458F-4EE2-9CA5-EFF2B819B5CB"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "psirt@us.ibm.com"
}