CVE-2017-1367

MediumCVSS 5.3/10Last modified Jun 17, 2026

Description

IBM Security Identity Governance and Intelligence Virtual Appliance 5.2 through 5.2.3.2 stores sensitive information in URL parameters. This may lead to information disclosure if unauthorized parties have access to the URLs via server logs, referrer header or browser history. IBM X-Force ID: 126860.

Metrics

CVSS 3.0 5.3/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-200

Affected software

Vendor	Product	Versions
IBM	Security Identity Governance and Intelligence	5.2; 5.2.1; 5.2.2; 5.2.2.1; 5.2.3; 5.2.3.1; 5.2.3.2

References

http://www.ibm.com/support/docview.wss?uid=swg22016869Patch, Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/126860Not Applicable, VDB Entry, Vendor Advisory
http://www.ibm.com/support/docview.wss?uid=swg22016869Patch, Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/126860Not Applicable, VDB Entry, Vendor Advisory

Timeline

Published: Jul 13, 2018
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2017

CVE-2017-136706.5In BlackCat CMS 1.2, remote authenticated users can upload any file via the media upload function in backend/media/ajax_upload.php, as demon CVE-2017-136716.1app/View/Helper/CommandHelper.php in MISP before 2.4.79 has persistent XSS via comments. It only impacts the users of the same instance beca CVE-2017-136725.5QEMU (aka Quick Emulator), when built with the VGA display emulator support, allows local guest OS privileged users to cause a denial of ser CVE-2017-136736.5The vga display update in mis-calculated the region for the dirty bitmap snapshot in case split screen mode is used causing a denial of serv CVE-2017-136747.8Symantec ProxyClient 3.4 for Windows is susceptible to a privilege escalation vulnerability. A malicious local Windows user can, under certa CVE-2017-136754.2A denial of service (DoS) attack in Symantec Endpoint Encryption before SEE 11.1.3HF2 allows remote attackers to make a particular machine o CVE-2017-136767.0Norton Remove & Reinstall can be susceptible to a DLL preloading vulnerability. These types of issues occur when an application looks to cal CVE-2017-136777.5Denial-of-service (DoS) vulnerability in the Symantec Advanced Secure Gateway (ASG) and ProxySG management consoles. A remote attacker can u CVE-2017-136784.8Stored XSS vulnerability in the Symantec Advanced Secure Gateway (ASG) and ProxySG management consoles. A malicious appliance administrator CVE-2017-136794.2A denial of service (DoS) attack in Symantec Encryption Desktop before SED 10.4.1 MP2HF1 allows remote attackers to make a particular machin CVE-2017-13686.5IBM Security Identity Governance Virtual Appliance 5.2 through 5.2.3.2 does not set the secure attribute on authorization tokens or session CVE-2017-136805.5Prior to SEP 12.1 RU6 MP9 & SEP 14 RU1 Symantec Endpoint Protection Windows endpoint can encounter a situation whereby an attacker could use