CVE-2015-4949

IBM Tivoli Storage Manager <7.1.2 & FlashCopy Manager <4.1.2 - Cleartext Password Exposure

Title source: llm
STIX 2.1

Description

IBM Tivoli Storage Manager for Databases: Data Protection for Microsoft SQL Server 7.1 before 7.1.2, Tivoli Storage Manager for Mail: Data Protection for Microsoft Exchange Server 7.1 before 7.1.2, and Tivoli Storage FlashCopy Manager 4.1 before 4.1.2 place cleartext passwords in exception messages, which allows physically proximate attackers to obtain sensitive information by reading GUI pop-up windows, a different vulnerability than CVE-2015-6557.

References (3)

Core 3
Core References
Vendor Advisory vendor-advisory x_refsource_aixapar
http://www-01.ibm.com/support/docview.wss?uid=swg1IT03480
Patch, Vendor Advisory x_refsource_confirm
http://www-01.ibm.com/support/docview.wss?uid=swg21963630
Third Party Advisory, VDB Entry vdb-entry x_refsource_sectrack
http://www.securitytracker.com/id/1033270

Scores

EPSS 0.0040
EPSS Percentile 31.5%

Details

CWE
CWE-200
Status published
Products (6)
ibm/tivoli_storage_flashcopy_manager 4.1.0
ibm/tivoli_storage_flashcopy_manager 4.1.2
ibm/tivoli_storage_manager_for_databases_data_protection_for_microsoft_sql_server 7.1
ibm/tivoli_storage_manager_for_databases_data_protection_for_microsoft_sql_server 7.2
ibm/tivoli_storage_manager_for_mail_data_protection_for_microsoft_exchange_server 7.1
ibm/tivoli_storage_manager_for_mail_data_protection_for_microsoft_exchange_server 7.2
Published Aug 23, 2015
Tracked Since Feb 18, 2026