CVE-2017-1411

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

IBM Security Identity Governance Virtual Appliance 5.2 through 5.2.3.2 does not require that users should have strong passwords by default, which makes it easier for attackers to compromise user accounts. IBM X-Force ID: 127399.

Metrics

CVSS 3.0 7.5/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-522

Affected software

Vendor	Product	Versions
IBM	Security Identity Governance and Intelligence	5.2; 5.2.1; 5.2.2; 5.2.2.1; 5.2.3; 5.2.3.1; 5.2.3.2

References

http://www.ibm.com/support/docview.wss?uid=swg22016869Patch, Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/127399VDB Entry
http://www.ibm.com/support/docview.wss?uid=swg22016869Patch, Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/127399VDB Entry

Timeline

Published: Aug 6, 2018
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2017

CVE-2017-141117.2The workstation logging function in Philips IntelliSpace Cardiovascular (ISCV) 2.3.0 and earlier and Xcelera R4.1L1 and earlier records doma CVE-2017-141146.5RTPproxy through 2.2.alpha.20160822 has a NAT feature that results in not properly determining the IP address and port number of the legitim CVE-2017-141158.1The AT&T U-verse 9.2.2h0d83 firmware for the Arris NVG589 and NVG599 devices, when IP Passthrough mode is not used, configures ssh-permanent CVE-2017-141168.1The AT&T U-verse 9.2.2h0d83 firmware for the Arris NVG599 device, when IP Passthrough mode is not used, configures WAN access to a caserver CVE-2017-141175.9The AT&T U-verse 9.2.2h0d83 firmware for the Arris NVG589 and NVG599 devices, when IP Passthrough mode is not used, configures an unauthenti CVE-2017-141188.8In the EyesOfNetwork web interface (aka eonweb) 5.1-0, module\tool_all\tools\interface.php does not properly restrict exec calls, which allo CVE-2017-141198.8In the EyesOfNetwork web interface (aka eonweb) 5.1-0, module\tool_all\tools\snmpwalk.php does not properly restrict popen calls, which allo CVE-2017-14124.3IBM Security Identity Governance Virtual Appliance 5.2 through 5.2.3.2 generates an error message that includes sensitive information about CVE-2017-141207.5unrar 0.0.1 (aka unrar-free or unrar-gpl) suffers from a directory traversal vulnerability for RAR v2 archives: pathnames of the form ../[fi CVE-2017-141215.5The DecodeNumber function in unrarlib.c in unrar 0.0.1 (aka unrar-free or unrar-gpl) suffers from a NULL pointer dereference flaw triggered CVE-2017-141229.1unrar 0.0.1 (aka unrar-free or unrar-gpl) suffers from a stack-based buffer over-read in unrarlib.c, related to ExtrFile and stricomp.CVE-2017-141238.8Zoho ManageEngine Firewall Analyzer 12200 has an unrestricted File Upload vulnerability in the "Group Chat" section. Any user can upload fil