CVE-2012-5756

Severity Score

4.3

*CVSS v2

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

*Multiple Sources

Exploited in Wild

*KEV

Decision

*SSVC

Descriptions

The IBM WebSphere DataPower XC10 Appliance 2.0.0.0 through 2.0.0.3 and 2.1.0.0 through 2.1.0.2, when a collective configuration is enabled, has a single secret key that is shared across different customers' installations, which allows remote attackers to spoof a container server by (1) sniffing the network to locate a cleartext transmission of this key or (2) leveraging knowledge of this key from another installation.

El IBM WebSphere DataPower XC10 Appliance v2.0.0.0 hasta v2.0.0.3 y v2.1.0.0 hasta v2.1.0.2, cuando una configuración colectiva está habilitada, tiene una única clave secreta que se comparte entre diferentes instalaciones de los clientes, lo que permite a atacantes remotos falsificar un servidor de contenedores mediante (1) escuchando la red para localizar una transmisión en texto claro de esta clave o (2) el conocimiento de esta llave de otra instalación.

*Credits: N/A

CVSS Scores

NISTv2 4.3

Attack Vector

Network

Attack Complexity

Medium

Authentication

None

Confidentiality

None

Integrity

Partial

Availability

None

* Common Vulnerability Scoring System

SSVC

Decision:-

Exploitation

Automatable

Tech. Impact

* Organization's Worst-case Scenario

Timeline

2012-11-02 CVE Reserved
2012-11-23 CVE Published
2023-03-07 EPSS Updated
2024-08-06 CVE Updated
---------- Exploited in Wild
---------- KEV Due Date
---------- First Exploit

CWE

CWE-310: Cryptographic Issues

CAPEC

References (7)

URL	Tag	Source
http://secunia.com/advisories/51319	Third Party Advisory
http://www-01.ibm.com/support/docview.wss?uid=swg24033740	X_refsource_confirm
http://www.securityfocus.com/bid/56617	Vdb Entry
http://www.securitytracker.com/id?1027798	Vdb Entry
https://exchange.xforce.ibmcloud.com/vulnerabilities/79921	Vdb Entry

URL	Date	SRC

URL	Date	SRC

URL	Date	SRC
http://www-01.ibm.com/support/docview.wss?uid=swg1PM68926	2017-08-29
http://www-01.ibm.com/support/docview.wss?uid=swg21615783	2017-08-29

Affected Vendors, Products, and Versions

Vendor		Product				Version		Other		Status
Vendor	Product	Version	Other	Status	<-- -->	Vendor	Product	Version	Other	Status
Ibm Search vendor "Ibm"		Websphere Datapower Xc10 Appliance Search vendor "Ibm" for product "Websphere Datapower Xc10 Appliance"				2.0.0.0 Search vendor "Ibm" for product "Websphere Datapower Xc10 Appliance" and version "2.0.0.0"		-		Affected
Ibm Search vendor "Ibm"		Websphere Datapower Xc10 Appliance Search vendor "Ibm" for product "Websphere Datapower Xc10 Appliance"				2.0.0.1 Search vendor "Ibm" for product "Websphere Datapower Xc10 Appliance" and version "2.0.0.1"		-		Affected
Ibm Search vendor "Ibm"		Websphere Datapower Xc10 Appliance Search vendor "Ibm" for product "Websphere Datapower Xc10 Appliance"				2.0.0.2 Search vendor "Ibm" for product "Websphere Datapower Xc10 Appliance" and version "2.0.0.2"		-		Affected
Ibm Search vendor "Ibm"		Websphere Datapower Xc10 Appliance Search vendor "Ibm" for product "Websphere Datapower Xc10 Appliance"				2.0.0.3 Search vendor "Ibm" for product "Websphere Datapower Xc10 Appliance" and version "2.0.0.3"		-		Affected
Ibm Search vendor "Ibm"		Websphere Datapower Xc10 Appliance Search vendor "Ibm" for product "Websphere Datapower Xc10 Appliance"				2.1.0.0 Search vendor "Ibm" for product "Websphere Datapower Xc10 Appliance" and version "2.1.0.0"		-		Affected
Ibm Search vendor "Ibm"		Websphere Datapower Xc10 Appliance Search vendor "Ibm" for product "Websphere Datapower Xc10 Appliance"				2.1.0.1 Search vendor "Ibm" for product "Websphere Datapower Xc10 Appliance" and version "2.1.0.1"		-		Affected
Ibm Search vendor "Ibm"		Websphere Datapower Xc10 Appliance Search vendor "Ibm" for product "Websphere Datapower Xc10 Appliance"				2.1.0.2 Search vendor "Ibm" for product "Websphere Datapower Xc10 Appliance" and version "2.1.0.2"		-		Affected