CVE-2016-6027: XSS
The Configuration Manager in IBM Sterling Secure Proxy (SSP) 3.4.2 before 3.4.2.0 iFix 8 and 3.4.3 before 3.4.3.0 iFix 1 does not enable the HSTS protection mechanism, which makes it easier for remote attackers to obtain sensitive information or modify data by leveraging use of HTTP.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2016-6027?
CVE-2016-6027 is classified as a medium severity vulnerability due to the potential exposure of sensitive information.
How do I fix CVE-2016-6027?
To fix CVE-2016-6027, upgrade IBM Sterling Secure Proxy to version 3.4.2.0 iFix 8 or 3.4.3.0 iFix 1 or later.
What products are affected by CVE-2016-6027?
CVE-2016-6027 affects IBM Sterling Secure Proxy versions 3.4.2.0 and 3.4.3.0 prior to the respective iFix releases.
What does CVE-2016-6027 exploit?
CVE-2016-6027 exploits the lack of HSTS protection, making it easier for attackers to intercept requests.
Is my data safe if I use an affected version of IBM Sterling Secure Proxy for CVE-2016-6027?
Using an affected version of IBM Sterling Secure Proxy poses a risk to your sensitive data, as attackers may obtain or modify it.