CVE-2014-6176: Medium severity ibm business process manager vulnerability
IBM WebSphere Process Server 7.0, WebSphere Enterprise Service Bus 7.0, and Business Process Manager Advanced 7.5.x through 7.5.1.2, 8.0.x through 8.0.1.3, and 8.5.x through 8.5.5 disregard the SSL setting in the SCA module HTTP import binding and unconditionally select the SSLv3 protocol, which makes it easier for remote attackers to hijack sessions or obtain sensitive information by leveraging the use of a weak cipher.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2014-6176?
CVE-2014-6176 has a high severity rating due to the use of the SSLv3 protocol which is vulnerable to attacks.
How do I fix CVE-2014-6176?
To fix CVE-2014-6176, you should configure your server to disable SSLv3 and enforce the use of more secure protocols.
What software versions are affected by CVE-2014-6176?
CVE-2014-6176 affects IBM Business Process Manager versions 7.5.x to 8.5.x, as well as IBM WebSphere Process Server 7.0 and WebSphere Enterprise Service Bus 7.0.
What issues can arise from CVE-2014-6176?
CVE-2014-6176 can lead to potential man-in-the-middle attacks due to the vulnerabilities associated with SSLv3.
Is there a workaround for CVE-2014-6176?
A possible workaround for CVE-2014-6176 includes setting up additional security measures such as stronger encryption protocols until a patch is finalized.