« Volver al listado

CVE-2016-0340

Estado: ModificadaAlta (7.4)—

IBM Security Identity Manager (ISIM) Virtual Appliance 7.0.0.0 through 7.0.1.1 before 7.0.1-ISS-SIM-FP0003 mishandles session expiration, which allows remote attackers to hijack sessions by leveraging an unattended workstation.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

IBM — Security Identity Manager Adapter

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2016-0340",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 4.4,
          "accessVector": "LOCAL",
          "vectorString": "AV:L/AC:M/Au:N/C:P/I:P/A:P",
          "authentication": "NONE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "MEDIUM",
          "availabilityImpact": "PARTIAL",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 6.4,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 3.4,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV30": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.0",
          "baseScore": 7.4,
          "attackVector": "LOCAL",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.0/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "HIGH",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 1.4
      }
    ]
  },
  "affected": [
    {
      "source": "psirt@us.ibm.com",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2016-07-15T18:59:05.203",
  "references": [
    {
      "url": "http://www-01.ibm.com/support/docview.wss?uid=swg21985736",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "psirt@us.ibm.com"
    },
    {
      "url": "http://www.securityfocus.com/bid/91692",
      "source": "psirt@us.ibm.com"
    },
    {
      "url": "http://www.securitytracker.com/id/1036255",
      "source": "psirt@us.ibm.com"
    },
    {
      "url": "http://www-01.ibm.com/support/docview.wss?uid=swg21985736",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.securityfocus.com/bid/91692",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.securitytracker.com/id/1036255",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-284"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "IBM Security Identity Manager (ISIM) Virtual Appliance 7.0.0.0 through 7.0.1.1 before 7.0.1-ISS-SIM-FP0003 mishandles session expiration, which allows remote attackers to hijack sessions by leveraging an unattended workstation."
    },
    {
      "lang": "es",
      "value": "IBM Security Identity Manager (ISIM) Virtual Appliance 7.0.0.0 hasta la versión 7.0.1.1 en versiones anteriores a 7.0.1-ISS-SIM-FP0003 maneja incorrectamente el vencimiento de sesión, lo que permite a atacantes remotos secuestrar sesiones aprovechando una estación de trabajo desatendida."
    }
  ],
  "lastModified": "2026-06-17T00:37:21.610",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:ibm:security_identity_manager_adapter:7.0.0.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "4F8FD871-0A5E-4413-8F1C-4125DA7741CB"
            },
            {
              "criteria": "cpe:2.3:a:ibm:security_identity_manager_adapter:7.0.0.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "17761140-202D-46B4-A955-F20FB7E4202E"
            },
            {
              "criteria": "cpe:2.3:a:ibm:security_identity_manager_adapter:7.0.0.2:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "9238298D-D05D-4E71-A824-36D50820482E"
            },
            {
              "criteria": "cpe:2.3:a:ibm:security_identity_manager_adapter:7.0.0.3:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "CE2D15D2-AA55-4077-AD96-8E380FD326C5"
            },
            {
              "criteria": "cpe:2.3:a:ibm:security_identity_manager_adapter:7.0.1.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "2FA93FE3-93FF-40E4-B8CC-F078310C1B81"
            },
            {
              "criteria": "cpe:2.3:a:ibm:security_identity_manager_adapter:7.0.1.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "A2E94FC6-A188-4029-A855-AC9F4BC6539D"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "psirt@us.ibm.com"
}