CVE-2017-1143

MEDIUM

IBM Kenexa LCMS Premier on Cloud <10.0 - Info Disclosure

Title source: llm

Description

IBM Kenexa LCMS Premier on Cloud 9.x and 10.0 could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable HTTP Strict Transport Security. An attacker could exploit this vulnerability to obtain sensitive information using man in the middle techniques. IBM Reference #: 1998874.

References (2)

[Mitigation, Vendor Advisory] http://www.ibm.com/support/docview.wss?uid=swg21998874

[Third Party Advisory, VDB Entry] http://www.securityfocus.com/bid/97079

Scores

CVSS v3 5.3

EPSS 0.0014

EPSS Percentile 33.6%

Attack Vector NETWORK

CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N

Classification

CWE

CWE-200

Status published

Affected Products (20)

ibm/kenexa_lcms_premier

IBM Corporation/Kenexa LCMS Premier on Cloud < 9.0

IBM Corporation/Kenexa LCMS Premier on Cloud < 9.1

IBM Corporation/Kenexa LCMS Premier on Cloud < 9.2

IBM Corporation/Kenexa LCMS Premier on Cloud < 9.2.1

IBM Corporation/Kenexa LCMS Premier on Cloud < 9.3.0

IBM Corporation/Kenexa LCMS Premier on Cloud < 9.4.0

... and 5 more

Timeline

Published Mar 27, 2017

Tracked Since Feb 18, 2026