First published: Wed Jul 05 2017(Updated: )
IBM WebSphere Message Broker stores user credentials in plain in clear text which can be read by a local user. IBM X-Force ID: 123777.
Credit: psirt@us.ibm.com
Affected Software | Affected Version | How to fix |
---|---|---|
IBM WebSphere Message Broker | =8.0.0.0 | |
IBM WebSphere Message Broker | =8.0.0.1 | |
IBM WebSphere Message Broker | =8.0.0.2 | |
IBM WebSphere Message Broker | =8.0.0.3 | |
IBM WebSphere Message Broker | =8.0.0.4 | |
IBM WebSphere Message Broker | =8.0.0.5 | |
IBM WebSphere Message Broker | =8.0.0.6 | |
IBM WebSphere Message Broker | =8.0.0.7 | |
IBM Integration Bus | =9.0.0 | |
IBM Integration Bus | =9.0.0.1 | |
IBM Integration Bus | =9.0.0.2 | |
IBM Integration Bus | =9.0.0.3 | |
IBM Integration Bus | =9.0.0.4 | |
IBM Integration Bus | =9.0.0.5 | |
IBM Integration Bus | =9.0.0.6 | |
IBM Integration Bus | =9.0.0.7 | |
IBM Integration Bus | =10.0.0 | |
IBM Integration Bus | =10.0.0.1 | |
IBM Integration Bus | =10.0.0.2 | |
IBM Integration Bus | =10.0.0.3 | |
IBM Integration Bus | =10.0.0.4 | |
IBM Integration Bus | =10.0.0.5 | |
IBM Integration Bus | =10.0.0.6 | |
IBM Integration Bus | =10.0.0.7 |
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
CVE-2017-1207 has a medium severity rating due to the exposure of user credentials in plain text.
To fix CVE-2017-1207, secure user credentials by storing them in an encrypted format and apply any available patches from IBM.
CVE-2017-1207 affects IBM WebSphere Message Broker versions 8.0.0.0 through 8.0.0.7 and IBM Integration Bus versions 9.0.0 through 10.0.7.
The risks associated with CVE-2017-1207 include unauthorized access to user credentials by local users, potentially leading to data breaches.
While the recommended solution is to patch the software, an immediate workaround includes implementing strict access controls to limit local user access.