CVE-2016-3021: Infoleak
Published Feb 1, 2017
·Updated
IBM Security Access Manager for Web could allow an authenticated attacker to obtain sensitive information from error message using a specially crafted HTTP request.
Affected Software
76 affected components
IBM Security Access Manager 9.0 Firmware=9.0.0
IBM Security Access Manager 9.0 Firmware=9.0.0.1
IBM Security Access Manager 9.0 Firmware=9.0.1.0
IBM Security Access Manager For Mobile 8.0 Firmware=8.0.0.1
IBM Security Access Manager For Mobile 8.0 Firmware=8.0.0.2
IBM Security Access Manager For Mobile 8.0 Firmware=8.0.0.3
IBM Security Access Manager For Mobile 8.0 Firmware=8.0.0.5
IBM Security Access Manager For Mobile 8.0 Firmware=8.0.1.0
IBM Security Access Manager For Mobile 8.0 Firmware=8.0.1.2
IBM Security Access Manager For Mobile 8.0 Firmware=8.0.1.3
IBM Security Access Manager For Mobile 8.0 Firmware=8.0.1.4
IBM Security Access Manager For Web 7.0 Firmware=7.0.0.1
IBM Security Access Manager For Web 7.0 Firmware=7.0.0.2
IBM Security Access Manager For Web 7.0 Firmware=7.0.0.3
IBM Security Access Manager For Web 7.0 Firmware=7.0.0.4
IBM Security Access Manager For Web 7.0 Firmware=7.0.0.5
IBM Security Access Manager For Web 7.0 Firmware=7.0.0.6
IBM Security Access Manager For Web 7.0 Firmware=7.0.0.7
IBM Security Access Manager For Web 7.0 Firmware=7.0.0.8
IBM Security Access Manager For Web 7.0 Firmware=7.0.0.9
IBM Security Access Manager For Web 7.0 Firmware=7.0.0.10
IBM Security Access Manager For Web 7.0 Firmware=7.0.0.11
IBM Security Access Manager For Web 7.0 Firmware=7.0.0.12
IBM Security Access Manager For Web 7.0 Firmware=7.0.0.13
IBM Security Access Manager For Web 7.0 Firmware=7.0.0.14
IBM Security Access Manager For Web 7.0 Firmware=7.0.0.15
IBM Security Access Manager For Web 7.0 Firmware=7.0.0.16
IBM Security Access Manager For Web 8.0 Firmware=8.0.0.1
IBM Security Access Manager For Web 8.0 Firmware=8.0.0.2
IBM Security Access Manager For Web 8.0 Firmware=8.0.0.3
IBM Security Access Manager For Web 8.0 Firmware=8.0.0.5
IBM Security Access Manager For Web 8.0 Firmware=8.0.1.0
IBM Security Access Manager For Web 8.0 Firmware=8.0.1.2
IBM Security Access Manager For Web 8.0 Firmware=8.0.1.3
IBM Security Access Manager For Web 8.0 Firmware=8.0.1.4
IBM Security Access Manager For Mobile Appliance=8.0
IBM Security Access Manager For Web Appliance=7.0
IBM Security Access Manager For Web Appliance=8.0
All of the following
Any of the following
IBM Security Access Manager 9.0 Firmware=9.0.0
IBM Security Access Manager 9.0 Firmware=9.0.0.1
IBM Security Access Manager 9.0 Firmware=9.0.1.0
IBM Security Access Manager For Mobile 8.0 Firmware=8.0.0.1
IBM Security Access Manager For Mobile 8.0 Firmware=8.0.0.2
IBM Security Access Manager For Mobile 8.0 Firmware=8.0.0.3
IBM Security Access Manager For Mobile 8.0 Firmware=8.0.0.5
IBM Security Access Manager For Mobile 8.0 Firmware=8.0.1.0
IBM Security Access Manager For Mobile 8.0 Firmware=8.0.1.2
IBM Security Access Manager For Mobile 8.0 Firmware=8.0.1.3
IBM Security Access Manager For Mobile 8.0 Firmware=8.0.1.4
IBM Security Access Manager For Web 7.0 Firmware=7.0.0.1
IBM Security Access Manager For Web 7.0 Firmware=7.0.0.2
IBM Security Access Manager For Web 7.0 Firmware=7.0.0.3
IBM Security Access Manager For Web 7.0 Firmware=7.0.0.4
IBM Security Access Manager For Web 7.0 Firmware=7.0.0.5
IBM Security Access Manager For Web 7.0 Firmware=7.0.0.6
IBM Security Access Manager For Web 7.0 Firmware=7.0.0.7
IBM Security Access Manager For Web 7.0 Firmware=7.0.0.8
IBM Security Access Manager For Web 7.0 Firmware=7.0.0.9
IBM Security Access Manager For Web 7.0 Firmware=7.0.0.10
IBM Security Access Manager For Web 7.0 Firmware=7.0.0.11
IBM Security Access Manager For Web 7.0 Firmware=7.0.0.12
IBM Security Access Manager For Web 7.0 Firmware=7.0.0.13
IBM Security Access Manager For Web 7.0 Firmware=7.0.0.14
IBM Security Access Manager For Web 7.0 Firmware=7.0.0.15
IBM Security Access Manager For Web 7.0 Firmware=7.0.0.16
IBM Security Access Manager For Web 8.0 Firmware=8.0.0.1
IBM Security Access Manager For Web 8.0 Firmware=8.0.0.2
IBM Security Access Manager For Web 8.0 Firmware=8.0.0.3
IBM Security Access Manager For Web 8.0 Firmware=8.0.0.5
IBM Security Access Manager For Web 8.0 Firmware=8.0.1.0
IBM Security Access Manager For Web 8.0 Firmware=8.0.1.2
IBM Security Access Manager For Web 8.0 Firmware=8.0.1.3
IBM Security Access Manager For Web 8.0 Firmware=8.0.1.4
Any of the following
IBM Security Access Manager For Mobile Appliance=8.0
IBM Security Access Manager For Web Appliance=7.0
IBM Security Access Manager For Web Appliance=8.0
Event History
Feb 1, 2017
CVE Published
via MITRE·08:00 PM
Data Sourced
via MITRE·08:00 PM
DescriptionWeakness
Data Sourced
via NVD·08:59 PM
DescriptionSeverityWeaknessAffected Software
Dec 13, 58332
Event
02:19 PM
Frequently Asked Questions
1
What is the severity of CVE-2016-3021?
CVE-2016-3021 has a medium severity rating as it allows authenticated attackers to access sensitive information through crafted HTTP requests.
2
How do I fix CVE-2016-3021?
To fix CVE-2016-3021, apply the latest patches provided by IBM for affected versions of IBM Security Access Manager.
3
Which versions are affected by CVE-2016-3021?
CVE-2016-3021 affects IBM Security Access Manager for Web versions 7.0.0.1 to 7.0.0.16 and 8.0.0.1 to 8.0.1.4, as well as IBM Security Access Manager for Mobile versions 8.0.0.1 to 8.0.1.4.
4
What type of attacks exploit CVE-2016-3021?
CVE-2016-3021 can be exploited by authenticated users to extract sensitive information from system error messages.
5
Is CVE-2016-3021 a remote or local vulnerability?
CVE-2016-3021 is considered a local vulnerability since it requires authentication to exploit.