CVE-2017-1143
Estado: ModificadaMedia (5.3)—
IBM Kenexa LCMS Premier on Cloud 9.x and 10.0 could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable HTTP Strict Transport Security. An attacker could exploit this vulnerability to obtain sensitive information using man in the middle techniques. IBM Reference #: 1998874.
CVSS
- Versión: 3.0
- Vector: CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N
- Puntuación base: 5.3
Probabilidad de explotación (EPSS)
- Probabilidad de explotación en los próximos 30 días: 0.92%
- Percentil entre todas las CVEs puntuadas: 59
- Fecha de la puntuación: 5/10/2026
EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).
Tecnologías afectadas (1)
CWE
- CWE-200
Referencias
JSON original (NVD)
Mostrar
{
"id": "CVE-2017-1143",
"cveTags": [],
"metrics": {
"cvssMetricV2": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"cvssData": {
"version": "2.0",
"baseScore": 3.5,
"accessVector": "NETWORK",
"vectorString": "AV:N/AC:M/Au:S/C:P/I:N/A:N",
"authentication": "SINGLE",
"integrityImpact": "NONE",
"accessComplexity": "MEDIUM",
"availabilityImpact": "NONE",
"confidentialityImpact": "PARTIAL"
},
"acInsufInfo": false,
"impactScore": 2.9,
"baseSeverity": "LOW",
"obtainAllPrivilege": false,
"exploitabilityScore": 6.8,
"obtainUserPrivilege": false,
"obtainOtherPrivilege": false,
"userInteractionRequired": false
}
],
"cvssMetricV30": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"cvssData": {
"scope": "UNCHANGED",
"version": "3.0",
"baseScore": 5.3,
"attackVector": "NETWORK",
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N",
"integrityImpact": "NONE",
"userInteraction": "NONE",
"attackComplexity": "HIGH",
"availabilityImpact": "NONE",
"privilegesRequired": "LOW",
"confidentialityImpact": "HIGH"
},
"impactScore": 3.6,
"exploitabilityScore": 1.6
}
]
},
"affected": [
{
"source": "psirt@us.ibm.com",
"affectedData": [
{
"vendor": "IBM Corporation",
"product": "Kenexa LCMS Premier on Cloud",
"versions": [
{
"status": "affected",
"version": "9.0"
},
{
"status": "affected",
"version": "9.1"
},
{
"status": "affected",
"version": "9.2"
},
{
"status": "affected",
"version": "9.2.1"
},
{
"status": "affected",
"version": "9.3.0"
},
{
"status": "affected",
"version": "9.4.0"
},
{
"status": "affected",
"version": "9.5.0"
},
{
"status": "affected",
"version": "10.0.0"
},
{
"status": "affected",
"version": "10.1.0"
},
{
"status": "affected",
"version": "10.2.0"
},
{
"status": "affected",
"version": "10.3.0"
}
]
}
]
}
],
"published": "2017-03-27T22:59:00.350",
"references": [
{
"url": "http://www.ibm.com/support/docview.wss?uid=swg21998874",
"tags": [
"Mitigation",
"Vendor Advisory"
],
"source": "psirt@us.ibm.com"
},
{
"url": "http://www.securityfocus.com/bid/97079",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"source": "psirt@us.ibm.com"
},
{
"url": "http://www.ibm.com/support/docview.wss?uid=swg21998874",
"tags": [
"Mitigation",
"Vendor Advisory"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "http://www.securityfocus.com/bid/97079",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
}
],
"vulnStatus": "Modified",
"weaknesses": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"description": [
{
"lang": "en",
"value": "CWE-200"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "IBM Kenexa LCMS Premier on Cloud 9.x and 10.0 could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable HTTP Strict Transport Security. An attacker could exploit this vulnerability to obtain sensitive information using man in the middle techniques. IBM Reference #: 1998874."
},
{
"lang": "es",
"value": "IBM Kenexa LCMS Premier on Cloud 9.x y 10.0 podrían permitir a un atacanter remoto obtener información sensible, provocado por el fallo para habilitar adecuadamente HTTP Strict Transport Security. Un atacante podría explotar esta vulnerabilidad para obtener información sensible utilizando técnicas man in the middle. Referencia IBM #: 1998874."
}
],
"lastModified": "2026-06-17T01:13:57.870",
"configurations": [
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:a:ibm:kenexa_lcms_premier:9.1:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "0B5A416C-F511-4016-B04E-1C8030755234"
},
{
"criteria": "cpe:2.3:a:ibm:kenexa_lcms_premier:9.2:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "424A977D-F0E8-4A5E-974A-62676F17599D"
},
{
"criteria": "cpe:2.3:a:ibm:kenexa_lcms_premier:9.2.1:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "BC1D6409-70BC-4ED0-A9A9-1A83EE61719D"
},
{
"criteria": "cpe:2.3:a:ibm:kenexa_lcms_premier:9.3:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "EA2557BE-4B29-4125-A39A-287F9F9FB6A8"
},
{
"criteria": "cpe:2.3:a:ibm:kenexa_lcms_premier:9.4:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "764D4D62-19BA-4DE7-A2D8-233C45CA26B3"
},
{
"criteria": "cpe:2.3:a:ibm:kenexa_lcms_premier:9.5:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "3037BB6F-26C8-4F39-9FB5-1EF592E46B36"
},
{
"criteria": "cpe:2.3:a:ibm:kenexa_lcms_premier:10.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "E386AA38-B144-43F7-9790-8C79B5FC88E5"
},
{
"criteria": "cpe:2.3:a:ibm:kenexa_lcms_premier:10.2:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "FA364F9B-AE53-402F-8FA9-EFDB45435964"
},
{
"criteria": "cpe:2.3:a:ibm:kenexa_lcms_premier:10.3:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "39991639-4A05-4AE8-B793-44A7B60F84F9"
}
],
"operator": "OR"
}
]
}
],
"sourceIdentifier": "psirt@us.ibm.com"
}