CVE-2016-2952

LOW

IBM BigFix Remote Control < 9.1.2 - Exposure of Sensitive Information via Missing HSTS Protection

Title source: llm
STIX 2.1

Description

IBM BigFix Remote Control before 9.1.3 does not enable the HSTS protection mechanism, which makes it easier for remote attackers to obtain sensitive information by leveraging use of HTTP.

References (3)

Core 3
Core References
Vendor Advisory vendor-advisory x_refsource_aixapar
http://www-01.ibm.com/support/docview.wss?uid=swg1IV89794
Third Party Advisory, VDB Entry vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/94598
Vendor Advisory x_refsource_confirm
http://www-01.ibm.com/support/docview.wss?uid=swg21991871

Scores

CVSS v3 3.7
EPSS 0.0156
EPSS Percentile 72.2%
Attack Vector NETWORK
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

Details

CWE
CWE-200
Status published
Products (1)
ibm/bigfix_remote_control < 9.1.2
Published Nov 30, 2016
Tracked Since Feb 18, 2026