CVE-2015-5013

MediumCVSS 5.5/10Last modified Jun 17, 2026

Description

The IBM Security Access Manager appliance includes configuration files that contain obfuscated plaintext-passwords which authenticated users can access.

Metrics

CVSS 3.1 5.5/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-522

Affected software

Vendor	Product	Versions
IBM Corporation	Access Manager	9.0; 9.0.0.1; 9.0.1; 7.0.0; 8.0.0; 8.0.0.1; 8.0.0.2; 8.0.0.3; 8.0.0.4; 8.0.0.5; 8.0.1; 8.0.1.2; 8.0.1.3; 8.0.1.4; 9.0.0; 9.0.1.0; 9.0.2.0

References

http://www.ibm.com/support/docview.wss?uid=swg21993722Patch, Vendor Advisory
http://www.securityfocus.com/bid/96090Third Party Advisory, VDB Entry
http://www.securitytracker.com/id/1037792Third Party Advisory, VDB Entry
http://www.ibm.com/support/docview.wss?uid=swg21993722Patch, Vendor Advisory
http://www.securityfocus.com/bid/96090Third Party Advisory, VDB Entry
http://www.securitytracker.com/id/1037792Third Party Advisory, VDB Entry

Timeline

Published: Feb 8, 2017
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2015

CVE-2015-50149.3IBM Cognos Disclosure Management (CDM) 10.1.x and 10.2.x before 10.2.4 IF10 allows man-in-the-middle attackers to obtain access by spoofing CVE-2015-50155.0IBM WebSphere Commerce Enterprise 7.0.0.9 and 8.x before Feature Pack 8 allows remote attackers to obtain sensitive information via a crafte CVE-2015-50164.3IBM Maximo Asset Management 7.1, 7.5, and 7.6; Maximo Asset Management Essentials 7.1 and 7.5; Control Desk 7.5 and 7.6; Tivoli Asset Manage CVE-2015-50175.4IBM Maximo Asset Management 7.1 through 7.1.1.13, 7.5.0 before 7.5.0.8 IFIX005, and 7.6.0 before 7.6.0.2 IFIX002; Maximo Asset Management 7.CVE-2015-50188.0IBM Security Access Manager for Web 7.0.0 before FP19 and 8.0 before 8.0.1.3 IF3, and Security Access Manager 9.0 before 9.0.0.0 IF1, allows CVE-2015-50195.5IBM Sterling Integrator 5.1 before 5010004_8 and Sterling B2B Integrator 5.2 before 5020500_9 allow remote authenticated users to read or up CVE-2015-50204.3The Big SQL component in IBM InfoSphere BigInsights 3.0, 3.0.0.1, 3.0.0.2, and 4.0 allows remote authenticated users to bypass intended acce CVE-2015-50215.5IBM InfoSphere Information Server 11.3 and 11.5 allows remote authenticated DataStage users to bypass intended job-execution restrictions or CVE-2015-50224.3IBM Multi-Enterprise Integration Gateway 1.x through 1.0.0.1 and B2B Advanced Communications 1.0.0.2 and 1.0.0.3 before 1.0.0.3_2, when acce CVE-2015-50235.4SQL injection vulnerability in IBM Curam Social Program Management 6.1 before 6.1.1 allows remote authenticated users to execute arbitrary S CVE-2015-50244.0IBM Emptoris Sourcing 10.0.2.0 before iFix6, 10.0.2.2 before iFix11, 10.0.2.3, 10.0.2.5 before iFix4, 10.0.2.6 before iFix8, 10.0.2.7 before CVE-2015-50355.4Cross-site scripting (XSS) vulnerability in IBM Connections 3.x before 3.0.1.1 CR3, 4.0 before CR4, 4.5 before CR5, and 5.0 before CR3 allow