CVE-2014-8923

2015-03-2501:59:11

CWE-200

[email protected]

web.nvd.nist.gov

ibm tivoli

ibm security identity manager

active directory

cleartext password

log file

vulnerability

nvd

cve-2014-8923

1.9 Low

CVSS2

Attack Vector

LOCAL

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:L/AC:M/Au:N/C:P/I:N/A:N

5.8 Medium

AI Score

Confidence

Low

0.0004 Low

EPSS

Percentile

5.1%

JSON

The (1) IBM Tivoli Identity Manager Active Directory adapter before 5.1.24 and (2) IBM Security Identity Manager Active Directory adapter before 6.0.14 for IBM Security Identity Manager on Windows, when certain log and trace levels are configured, store the cleartext administrator password in a log file, which allows local users to obtain sensitive information by reading a file.

Affected configurations

NVD

Node

ibmsecurity_identity_manager_active_directory_adapterRange≤6.0.14windows

ibmtivoli_identity_manager_active_directory_adapterRange≤5.1.20windows

CPENameOperatorVersion
ibm:security_identity_manager_active_directory_adapteribm security identity manager active directory adapterle6.0.14
ibm:tivoli_identity_manager_active_directory_adapteribm tivoli identity manager active directory adapterle5.1.20

CPE	Name	Operator	Version
ibm:security_identity_manager_active_directory_adapter	ibm security identity manager active directory adapter	le	6.0.14
ibm:tivoli_identity_manager_active_directory_adapter	ibm tivoli identity manager active directory adapter	le	5.1.20