CVE-2014-6099
First published: Sun Oct 26 2014(Updated: )
The Change Password feature in IBM Sterling B2B Integrator 5.2.x through 5.2.4 does not have a lockout protection mechanism for invalid login requests, which makes it easier for remote attackers to obtain admin access via a brute-force approach.
Credit: psirt@us.ibm.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| IBM B2B Sterling Integrator | =5.2 | |
| IBM B2B Sterling Integrator | =5.2.4 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2014-6099?
The severity of CVE-2014-6099 is high due to the lack of a lockout mechanism allowing brute-force attacks on admin access.
How do I fix CVE-2014-6099?
To fix CVE-2014-6099, implement a lockout policy on the Change Password feature to prevent repeated invalid login attempts.
Who is affected by CVE-2014-6099?
CVE-2014-6099 affects users of IBM Sterling B2B Integrator versions 5.2.x up to and including 5.2.4.
What can an attacker achieve through CVE-2014-6099?
An attacker can exploit CVE-2014-6099 to gain unauthorized admin access using brute-force login attempts.
Is CVE-2014-6099 a network vulnerability?
CVE-2014-6099 is considered a web application vulnerability rather than a network vulnerability.
- agent/references
- agent/type
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/severity
- agent/author
- agent/weakness
- agent/last-modified-date
- agent/description
- agent/first-publish-date
- agent/event
- agent/source
- agent/tags
- collector/nvd-index
- agent/software-canonical-lookup-request
- vendor/ibm
- canonical/ibm b2b sterling integrator
- version/ibm b2b sterling integrator/5.2
- version/ibm b2b sterling integrator/5.2.4