CVE-2022-33161 - IBM Security Directory Server information disclosure

Back Back to CVE browser

MEDIUM

IBM Security Directory Server information disclosure

Published Oct 14, 2023

5.9

MEDIUM

CVSS 3.1

EPSS 0.55%

Description

IBM Security Directory Server 6.4.0 could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable HTTP Strict Transport Security. An attacker could exploit this vulnerability to obtain sensitive information using man in the middle techniques. X-Force ID: 228569.

Affected products

Vendor IBM Product Security Directory Server Default
unaffected
- Version
  6.4.0
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

IBM

Security Directory Server

unaffected

Version	Status	Constraints
6.4.0	affected	-

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-311

Missing Encryption of Sensitive Data

References (4)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-36206
Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/228569
vdb-entryVDB EntryVendor Advisory
https://www.ibm.com/support/pages/node/7047116
vendor-advisoryPatchVendor Advisory
https://www.ibm.com/support/pages/node/7047428
vendor-advisoryPatchVendor Advisory

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-36206		Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/228569		vdb-entryVDB EntryVendor Advisory
https://www.ibm.com/support/pages/node/7047116		vendor-advisoryPatchVendor Advisory
https://www.ibm.com/support/pages/node/7047428		vendor-advisoryPatchVendor Advisory