Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2013-5461

IBM Endpoint Manager for Remote Control 9.0.0 and 9.0.1 and Tivoli Remote Control 5.1.2 store multiple hashes of partial passwords, which makes it easier for remote attackers to decrypt passwords by leveraging access to the hashes. IBM X-Force ID: 88309.

Published

2018-04-27T16:29:00.300

Last Modified

2024-11-21T01:57:31.230

Status

Modified

Source

[email protected]

Severity

CVSSv3.0: 8.8 (HIGH)

CVSSv2 Vector

AV:N/AC:L/Au:S/C:P/I:N/A:N

Access Vector: NETWORK
Access Complexity: LOW
Authentication: SINGLE
Confidentiality Impact: PARTIAL
Integrity Impact: NONE
Availability Impact: NONE

Exploitability Score

8.0

Impact Score

2.9

Weaknesses

Type: Primary
CWE-255

Affected Vendors & Products

Type	Vendor	Product	Version/Range	Vulnerable?
Application	ibm	endpoint_manager_for_remote_control	9.0.0	Yes
Application	ibm	endpoint_manager_for_remote_control	9.0.1	Yes
Application	ibm	tivoli_remote_control	5.1.2	Yes

References

https://exchange.xforce.ibmcloud.com/vulnerabilities/88309 VDB Entry, Vendor Advisory ([email protected])
https://www.ibm.com/blogs/psirt/ibm-security-bulletin-insecure-storage-of-passwords-in-ibm-endpoint-manager-for-remote-control-cve-2013-5461/ Vendor Advisory ([email protected])
https://www.ibm.com/blogs/psirt/ibm-security-bulletin-insecure-storage-of-passwords-in-tivoli-remote-control-cve-2013-5461/ Vendor Advisory ([email protected])
https://exchange.xforce.ibmcloud.com/vulnerabilities/88309 VDB Entry, Vendor Advisory (af854a3a-2127-422b-91ae-364da2661108)
https://www.ibm.com/blogs/psirt/ibm-security-bulletin-insecure-storage-of-passwords-in-ibm-endpoint-manager-for-remote-control-cve-2013-5461/ Vendor Advisory (af854a3a-2127-422b-91ae-364da2661108)
https://www.ibm.com/blogs/psirt/ibm-security-bulletin-insecure-storage-of-passwords-in-tivoli-remote-control-cve-2013-5461/ Vendor Advisory (af854a3a-2127-422b-91ae-364da2661108)