cvelistv5 - cve-2016-3016

cve-2016-3016

Vulnerability from cvelistv5

Published

2017-02-01 20:00

Modified

2024-08-05 23:40

Severity ?

Summary

IBM Security Access Manager for Web processes patches, image backups and other updates without sufficiently verifying the origin and integrity of the code, which could allow an authenticated attacker to load malicious code.

References

▼	URL	Tags
	psirt@us.ibm.com	http://www.ibm.com/support/docview.wss?uid=swg21995518	Patch, Vendor Advisory
	af854a3a-2127-422b-91ae-364da2661108	http://www.ibm.com/support/docview.wss?uid=swg21995518	Patch, Vendor Advisory

Impacted products

Vendor

Product

Version

▼

IBM Corporation

Access Manager

Version: 9.0
Version: 9.0.0.1
Version: 9.0.1
Version: 7.0.0
Version: 8.0.0
Version: 8.0.0.1
Version: 8.0.0.2
Version: 8.0.0.3
Version: 8.0.0.4
Version: 8.0.0.5
Version: 8.0.1
Version: 8.0.1.2
Version: 8.0.1.3
Version: 8.0.1.4
Version: 9.0.0
Version: 9.0.1.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T23:40:14.421Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://www.ibm.com/support/docview.wss?uid=swg21995518"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Access Manager",
          "vendor": "IBM Corporation",
          "versions": [
            {
              "status": "affected",
              "version": "9.0"
            },
            {
              "status": "affected",
              "version": "9.0.0.1"
            },
            {
              "status": "affected",
              "version": "9.0.1"
            },
            {
              "status": "affected",
              "version": "7.0.0"
            },
            {
              "status": "affected",
              "version": "8.0.0"
            },
            {
              "status": "affected",
              "version": "8.0.0.1"
            },
            {
              "status": "affected",
              "version": "8.0.0.2"
            },
            {
              "status": "affected",
              "version": "8.0.0.3"
            },
            {
              "status": "affected",
              "version": "8.0.0.4"
            },
            {
              "status": "affected",
              "version": "8.0.0.5"
            },
            {
              "status": "affected",
              "version": "8.0.1"
            },
            {
              "status": "affected",
              "version": "8.0.1.2"
            },
            {
              "status": "affected",
              "version": "8.0.1.3"
            },
            {
              "status": "affected",
              "version": "8.0.1.4"
            },
            {
              "status": "affected",
              "version": "9.0.0"
            },
            {
              "status": "affected",
              "version": "9.0.1.0"
            }
          ]
        }
      ],
      "datePublic": "2017-02-01T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "IBM Security Access Manager for Web processes patches, image backups and other updates without sufficiently verifying the origin and integrity of the code, which could allow an authenticated attacker to load malicious code."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Gain Access",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2017-02-01T19:57:01",
        "orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
        "shortName": "ibm"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://www.ibm.com/support/docview.wss?uid=swg21995518"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "psirt@us.ibm.com",
          "ID": "CVE-2016-3016",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Access Manager",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "9.0"
                          },
                          {
                            "version_value": "9.0.0.1"
                          },
                          {
                            "version_value": "9.0.1"
                          },
                          {
                            "version_value": "7.0.0"
                          },
                          {
                            "version_value": "8.0.0"
                          },
                          {
                            "version_value": "8.0.0.1"
                          },
                          {
                            "version_value": "8.0.0.2"
                          },
                          {
                            "version_value": "8.0.0.3"
                          },
                          {
                            "version_value": "8.0.0.4"
                          },
                          {
                            "version_value": "8.0.0.5"
                          },
                          {
                            "version_value": "8.0.1"
                          },
                          {
                            "version_value": "8.0.1.2"
                          },
                          {
                            "version_value": "8.0.1.3"
                          },
                          {
                            "version_value": "8.0.1.4"
                          },
                          {
                            "version_value": "9.0.0"
                          },
                          {
                            "version_value": "9.0.1.0"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "IBM Corporation"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "IBM Security Access Manager for Web processes patches, image backups and other updates without sufficiently verifying the origin and integrity of the code, which could allow an authenticated attacker to load malicious code."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "Gain Access"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "http://www.ibm.com/support/docview.wss?uid=swg21995518",
              "refsource": "CONFIRM",
              "url": "http://www.ibm.com/support/docview.wss?uid=swg21995518"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
    "assignerShortName": "ibm",
    "cveId": "CVE-2016-3016",
    "datePublished": "2017-02-01T20:00:00",
    "dateReserved": "2016-03-09T00:00:00",
    "dateUpdated": "2024-08-05T23:40:14.421Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2016-3016\",\"sourceIdentifier\":\"psirt@us.ibm.com\",\"published\":\"2017-02-01T20:59:00.427\",\"lastModified\":\"2024-11-21T02:49:12.020\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"IBM Security Access Manager for Web processes patches, image backups and other updates without sufficiently verifying the origin and integrity of the code, which could allow an authenticated attacker to load malicious code.\"},{\"lang\":\"es\",\"value\":\"IBM Security Access Manager para Web procesa parches, copias de seguridad de im\u00e1genes y otras actualizaciones sin verificar suficientemente el origen y la integridad del c\u00f3digo, lo que podr\u00edan permitir a un atacante autenticado cargar c\u00f3digo malicioso.\"}],\"metrics\":{\"cvssMetricV30\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.0\",\"vectorString\":\"CVSS:3.0/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:H/A:N\",\"baseScore\":4.4,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"HIGH\",\"privilegesRequired\":\"HIGH\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":0.7,\"impactScore\":3.6}],\"cvssMetricV2\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"2.0\",\"vectorString\":\"AV:N/AC:M/Au:S/C:N/I:P/A:N\",\"baseScore\":3.5,\"accessVector\":\"NETWORK\",\"accessComplexity\":\"MEDIUM\",\"authentication\":\"SINGLE\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"PARTIAL\",\"availabilityImpact\":\"NONE\"},\"baseSeverity\":\"LOW\",\"exploitabilityScore\":6.8,\"impactScore\":2.9,\"acInsufInfo\":false,\"obtainAllPrivilege\":false,\"obtainUserPrivilege\":false,\"obtainOtherPrivilege\":false,\"userInteractionRequired\":false}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-345\"}]}],\"configurations\":[{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:ibm:security_access_manager_9.0_firmware:9.0.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"6B5B6BD9-C0DF-4359-A6C1-F66E24912800\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:ibm:security_access_manager_9.0_firmware:9.0.0.1:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"6F18D4AF-43DE-42A0-898E-50FBA7ADDDDE\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:ibm:security_access_manager_9.0_firmware:9.0.1.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"847598BF-977A-4592-A6A1-2C7F04F29FDC\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:ibm:security_access_manager_for_mobile_8.0_firmware:8.0.0.1:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"EA4B8E11-83D3-4B38-90B6-4C0F536D06B6\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:ibm:security_access_manager_for_mobile_8.0_firmware:8.0.0.2:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"AFD6FF12-A3AD-4D2B-92EB-44D20AF4DD9D\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:ibm:security_access_manager_for_mobile_8.0_firmware:8.0.0.3:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"AD7C3FED-3B2F-4EC9-9A9B-05EFDB0AA56B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:ibm:security_access_manager_for_mobile_8.0_firmware:8.0.0.5:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"250AF7A4-8DDF-427C-8BF7-788667908D77\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:ibm:security_access_manager_for_mobile_8.0_firmware:8.0.1.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"76136DDE-1530-482B-9E32-3EA2496FDFCA\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:ibm:security_access_manager_for_mobile_8.0_firmware:8.0.1.2:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"8CBEA0D7-FBD0-4C7D-AB8F-73018359996A\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:ibm:security_access_manager_for_mobile_8.0_firmware:8.0.1.3:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"7CCECD9C-D506-4AEA-AE59-49A81E2D7020\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:ibm:security_access_manager_for_mobile_8.0_firmware:8.0.1.4:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"FCB6511D-5B6C-4BBB-8DEF-C37026398D6C\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:ibm:security_access_manager_for_web_7.0_firmware:7.0.0.1:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"22433CE0-9772-48CE-8069-612FF3732C21\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:ibm:security_access_manager_for_web_7.0_firmware:7.0.0.2:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"2569AA28-5C61-4BBD-A501-E1ACFA36837B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:ibm:security_access_manager_for_web_7.0_firmware:7.0.0.3:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"79AFD6BE-4ED1-4A9C-AF30-F083A7A4F418\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:ibm:security_access_manager_for_web_7.0_firmware:7.0.0.4:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"3AB188A2-D7CE-4141-A55A-C074C84E366E\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:ibm:security_access_manager_for_web_7.0_firmware:7.0.0.5:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"DE776097-1DA4-4F27-8E96-61E3D9FFE8D0\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:ibm:security_access_manager_for_web_7.0_firmware:7.0.0.6:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"FE4E5283-0FEE-4F37-9C41-FA695063FF79\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:ibm:security_access_manager_for_web_7.0_firmware:7.0.0.7:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"39D9B9CF-5F3D-4CA3-87A0-AAE1BA5F09C1\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:ibm:security_access_manager_for_web_7.0_firmware:7.0.0.8:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"73EB6121-62CD-49FC-A1D2-5467B007253C\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:ibm:security_access_manager_for_web_7.0_firmware:7.0.0.9:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"A91ADDFE-9362-4D7E-B623-D662D81382E8\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:ibm:security_access_manager_for_web_7.0_firmware:7.0.0.10:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"C8E0F31E-EB32-4442-91BE-95A9625F308F\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:ibm:security_access_manager_for_web_7.0_firmware:7.0.0.11:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"701D729E-A817-4525-ADD9-EC810326B9E2\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:ibm:security_access_manager_for_web_7.0_firmware:7.0.0.12:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"E5883F2E-83F4-4630-813B-21E533BA2CB7\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:ibm:security_access_manager_for_web_7.0_firmware:7.0.0.13:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"A1FB9953-91A1-47BB-B6BF-088FA75BEBCA\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:ibm:security_access_manager_for_web_7.0_firmware:7.0.0.14:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"CD7B0192-465A-48EF-8B51-FC6BC6EC464A\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:ibm:security_access_manager_for_web_7.0_firmware:7.0.0.15:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"3E40F5AD-E090-4D0B-A580-D794F60215DB\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:ibm:security_access_manager_for_web_7.0_firmware:7.0.0.16:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"EC5BD4D1-DD9B-4845-AF17-9B813C748D1A\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:ibm:security_access_manager_for_web_8.0_firmware:8.0.0.1:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"4B0D27CF-70BF-4C72-A963-310272D8EBF7\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:ibm:security_access_manager_for_web_8.0_firmware:8.0.0.2:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"97E19969-DD73-42F2-9E91-504E1663B268\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:ibm:security_access_manager_for_web_8.0_firmware:8.0.0.3:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"F9CC2E05-5179-4241-A710-E582510EEB0D\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:ibm:security_access_manager_for_web_8.0_firmware:8.0.0.5:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"BD1366C8-9C78-4B40-8E40-19C4DFEC2B1D\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:ibm:security_access_manager_for_web_8.0_firmware:8.0.1.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"73E4F0CD-26DF-4975-8F40-ECB8E03A08C2\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:ibm:security_access_manager_for_web_8.0_firmware:8.0.1.2:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"FFE6F2A0-BD38-4853-A8FB-299A341FA0B6\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:ibm:security_access_manager_for_web_8.0_firmware:8.0.1.3:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"D0122CE6-44D9-4A5F-8DD4-B1F7F229FDFB\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:ibm:security_access_manager_for_web_8.0_firmware:8.0.1.4:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"D1C6294A-7243-499D-8371-F000BEB7CF2F\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:ibm:security_access_manager_for_mobile_appliance:8.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"506C4B29-BC71-4C56-BAB1-06E63BEB1DD3\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:ibm:security_access_manager_for_web_appliance:7.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"A7844D23-8DAB-4A9A-B0D4-734DF8FBFE02\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:ibm:security_access_manager_for_web_appliance:8.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"1C5EBB4D-36F8-453C-9D2C-A63490144596\"}]}]}],\"references\":[{\"url\":\"http://www.ibm.com/support/docview.wss?uid=swg21995518\",\"source\":\"psirt@us.ibm.com\",\"tags\":[\"Patch\",\"Vendor Advisory\"]},{\"url\":\"http://www.ibm.com/support/docview.wss?uid=swg21995518\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\",\"Vendor Advisory\"]}]}}"
  }
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.

Action not permitted

cve-2016-3016

Vulnerability from cvelistv5

gsd-2016-3016

Vulnerability from gsd

var-201702-0180

Vulnerability from variot

ghsa-prq3-j8m2-5xg7

Vulnerability from github

Tags

Sightings

Nomenclature