« Back to list

CVE-2017-1396

Status: ModifiedHigh (8.1)—

IBM Security Identity Governance Virtual Appliance 5.2 through 5.2.3.2 specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors. IBM X-Force ID: 127342.

CVSS

Exploitation probability (EPSS)

EPSS (Exploit Prediction Scoring System, FIRST) estimates how likely a vulnerability is to be exploited in the wild within 30 days. It complements CVSS (impact) and CISA KEV (confirmed exploitation).

Affected technologies (1)

IBM — Security Identity Governance AND Intelligence

CWEs

References

Raw JSON (NVD)

Show
{
  "id": "CVE-2017-1396",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 5.5,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:N",
          "authentication": "SINGLE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "LOW",
          "availabilityImpact": "NONE",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 4.9,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 8,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV30": [
      {
        "type": "Secondary",
        "source": "psirt@us.ibm.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.0",
          "baseScore": 4.2,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N",
          "integrityImpact": "LOW",
          "userInteraction": "NONE",
          "attackComplexity": "HIGH",
          "availabilityImpact": "NONE",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 2.5,
        "exploitabilityScore": 1.6
      },
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.0",
          "baseScore": 8.1,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.2,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "psirt@us.ibm.com",
      "affectedData": [
        {
          "vendor": "IBM",
          "product": "Security Identity Governance and Intelligence",
          "versions": [
            {
              "status": "affected",
              "version": "5.2"
            },
            {
              "status": "affected",
              "version": "5.2.1"
            },
            {
              "status": "affected",
              "version": "5.2.2"
            },
            {
              "status": "affected",
              "version": "5.2.2.1"
            },
            {
              "status": "affected",
              "version": "5.2.3"
            },
            {
              "status": "affected",
              "version": "5.2.3.1"
            },
            {
              "status": "affected",
              "version": "5.2.3.2"
            }
          ]
        }
      ]
    }
  ],
  "published": "2018-08-06T14:29:00.327",
  "references": [
    {
      "url": "http://www.ibm.com/support/docview.wss?uid=swg22016869",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "source": "psirt@us.ibm.com"
    },
    {
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/127342",
      "tags": [
        "VDB Entry"
      ],
      "source": "psirt@us.ibm.com"
    },
    {
      "url": "http://www.ibm.com/support/docview.wss?uid=swg22016869",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/127342",
      "tags": [
        "VDB Entry"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-275"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "IBM Security Identity Governance Virtual Appliance 5.2 through 5.2.3.2 specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors. IBM X-Force ID: 127342."
    },
    {
      "lang": "es",
      "value": "IBM Security Identity Governance Virtual Appliance, desde la versión 5.2 hasta la 5.2.3.2, especifica permisos para un recurso crítico para la seguridad de forma que permite que ese recurso sea leído o modificado por actores no planeados. IBM X-Force ID: 127342."
    }
  ],
  "lastModified": "2026-06-17T01:14:21.373",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:ibm:security_identity_governance_and_intelligence:5.2:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "21A3FF17-CA69-4AD0-9E2F-08EF894E4707"
            },
            {
              "criteria": "cpe:2.3:a:ibm:security_identity_governance_and_intelligence:5.2.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "0F8B59F0-C465-476F-9775-09D411D9C019"
            },
            {
              "criteria": "cpe:2.3:a:ibm:security_identity_governance_and_intelligence:5.2.2:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "CDADC801-315E-4B7F-8464-CEFC6934A657"
            },
            {
              "criteria": "cpe:2.3:a:ibm:security_identity_governance_and_intelligence:5.2.2.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "6ACF2C48-1490-4114-84D3-94F13D2375AD"
            },
            {
              "criteria": "cpe:2.3:a:ibm:security_identity_governance_and_intelligence:5.2.3:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "1DBF441F-7F14-4626-B705-8E422BAE4348"
            },
            {
              "criteria": "cpe:2.3:a:ibm:security_identity_governance_and_intelligence:5.2.3.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "0A5F964B-B22B-43F0-9B2D-F3FB3C0EF0B1"
            },
            {
              "criteria": "cpe:2.3:a:ibm:security_identity_governance_and_intelligence:5.2.3.2:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "6F7911BA-F5BF-44FD-A377-0B25EAFC2930"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "psirt@us.ibm.com"
}