CVE-2015-5010

HIGH

IBM Security Access Manager for Web 7.0-9.0 - Brute-Force Attack via Missing Login Lockout Mechanism

Title source: llm
STIX 2.1

Description

IBM Security Access Manager for Web 7.0 before 7.0.0 IF21, 8.0 before 8.0.1.3 IF4, and 9.0 before 9.0.0.1 IF1 does not have a lockout mechanism for invalid login attempts, which makes it easier for remote attackers to obtain access via a brute-force attack.

References (3)

Core 3
Core References
Patch, Vendor Advisory x_refsource_confirm
http://www-01.ibm.com/support/docview.wss?uid=swg21970508
Various Sources vendor-advisory x_refsource_aixapar
http://www-01.ibm.com/support/docview.wss?uid=swg1IV80728
Various Sources vendor-advisory x_refsource_aixapar
http://www-01.ibm.com/support/docview.wss?uid=swg1IV80694

Scores

CVSS v3 7.5
EPSS 0.0155
EPSS Percentile 72.5%
Attack Vector NETWORK
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Details

CWE
CWE-254
Status published
Products (29)
ibm/security_access_manager_9.0_firmware 9.0.0
ibm/security_access_manager_for_web_7.0_firmware 7.0.0.1
ibm/security_access_manager_for_web_7.0_firmware 7.0.0.2
ibm/security_access_manager_for_web_7.0_firmware 7.0.0.3
ibm/security_access_manager_for_web_7.0_firmware 7.0.0.4
ibm/security_access_manager_for_web_7.0_firmware 7.0.0.5
ibm/security_access_manager_for_web_7.0_firmware 7.0.0.6
ibm/security_access_manager_for_web_7.0_firmware 7.0.0.7
ibm/security_access_manager_for_web_7.0_firmware 7.0.0.8
ibm/security_access_manager_for_web_7.0_firmware 7.0.0.9
... and 19 more
Published Feb 15, 2016
Tracked Since Feb 18, 2026