CVE-2017-1309

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

IBM InfoSphere Master Data Management Server 11.0 - 11.6 stores user credentials in plain in clear text which can be read by a local user. IBM X-Force ID: 125463.

Metrics

CVSS 3.0 7.8/10CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-312

Affected software

Vendor	Product	Versions
IBM	InfoSphere Master Data Management	11.0; 11.3; 11.4; 11.5; 11.6

References

http://www.ibm.com/support/docview.wss?uid=swg22005437Patch, Vendor Advisory
http://www.securityfocus.com/bid/99872Third Party Advisory, VDB Entry
https://exchange.xforce.ibmcloud.com/vulnerabilities/125463VDB Entry, Vendor Advisory
http://www.ibm.com/support/docview.wss?uid=swg22005437Patch, Vendor Advisory
http://www.securityfocus.com/bid/99872Third Party Advisory, VDB Entry
https://exchange.xforce.ibmcloud.com/vulnerabilities/125463VDB Entry, Vendor Advisory

Timeline

Published: Jul 19, 2017
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2017

CVE-2017-130908.8The retr.c:fd_read_body() function is called when processing OK responses. When the response is sent chunked in wget before 1.19.2, the chun CVE-2017-130917.8The P1735 IEEE standard describes flawed methods for encrypting electronic-design intellectual property (IP), as well as the management of a CVE-2017-130927.8The P1735 IEEE standard describes flawed methods for encrypting electronic-design intellectual property (IP), as well as the management of a CVE-2017-130937.8The P1735 IEEE standard describes flawed methods for encrypting electronic-design intellectual property (IP), as well as the management of a CVE-2017-130947.8The P1735 IEEE standard describes flawed methods for encrypting electronic-design intellectual property (IP), as well as the management of a CVE-2017-130957.8The P1735 IEEE standard describes flawed methods for encrypting electronic-design intellectual property (IP), as well as the management of a CVE-2017-130967.8The P1735 IEEE standard describes flawed methods for encrypting electronic-design intellectual property (IP), as well as the management of a CVE-2017-130977.8The P1735 IEEE standard describes flawed methods for encrypting electronic-design intellectual property (IP), as well as the management of a CVE-2017-130985.9BouncyCastle TLS prior to version 1.0.3, when configured to use the JCE (Java Cryptography Extension) for cryptographic functions, provides CVE-2017-130995.9wolfSSL prior to version 3.12.2 provides a weak Bleichenbacher oracle when any TLS cipher suite using RSA key exchange is negotiated. An att CVE-2017-13106.5IBM Informix Dynamic Server 12.1 could allow an authenticated user to cause a buffer overflow that would write large assertion fail files to CVE-2017-131007.5DistinctDev, Inc., The Moron Test, 6.3.1, 2017-05-04, iOS application uses a hard-coded key for encryption. Data stored using this key can b