CVE-2012-5756 — MEDIUM (4.3)

Vulnerability Description

The IBM WebSphere DataPower XC10 Appliance 2.0.0.0 through 2.0.0.3 and 2.1.0.0 through 2.1.0.2, when a collective configuration is enabled, has a single secret key that is shared across different customers' installations, which allows remote attackers to spoof a container server by (1) sniffing the network to locate a cleartext transmission of this key or (2) leveraging knowledge of this key from another installation.

CVSS Score

4.3

MEDIUM

AV:N/AC:M/Au:N/C:N/I:P/A:N

Confidentiality

NONE

Integrity

PARTIAL

Availability

NONE

Affected Products

Vendor	Product	Versions
Ibm	Websphere Datapower Xc10 Appliance	2.0.0.0

Related Weaknesses (CWE)

CWE-310

References

FAQ

What is CVE-2012-5756?

CVE-2012-5756 is a vulnerability with a CVSS score of 4.3 (MEDIUM). The IBM WebSphere DataPower XC10 Appliance 2.0.0.0 through 2.0.0.3 and 2.1.0.0 through 2.1.0.2, when a collective configuration is enabled, has a single secret key that is shared across different cust...

How severe is CVE-2012-5756?

CVE-2012-5756 has been rated MEDIUM with a CVSS base score of 4.3/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2012-5756?

Check the references section above for vendor advisories and patch information. Affected products include: Ibm Websphere Datapower Xc10 Appliance.