CVE-2016-2929
HighSummary
IBM BigFix Remote Control before 9.1.3 does not properly restrict password choices, which makes it easier for remote attackers to obtain access via a brute-force approach.
Risk Assessment
The organization may be exposed to unauthorized access to systems, potentially leading to data loss or security breaches.
Recommendation
It is recommended to update IBM BigFix Remote Control to version 9.1.3 or later and implement strong password policies.
Other vulnerabilities in IBM BigFix Remote Control
See all- CVE-2016-2930High
IBM BigFix Remote Control version 9.1.3 could allow a remote attacker to perform actions reserved for an administrator without authentication.
- CVE-2016-2963High
CVE-2016-2963 is a CSRF vulnerability in IBM BigFix Remote Control before version 9.1.3 that allows remote attackers to hijack the authentication of arbitrary users for requests that insert XSS sequences.
- CVE-2016-2948High
IBM BigFix Remote Control before 9.1.3 allows local users to discover hardcoded credentials via unspecified vectors.
- CVE-2016-2936High
IBM BigFix Remote Control before version 9.1.3 uses cleartext storage for passwords, allowing local users to obtain sensitive information.
- CVE-2016-2944Critical
IBM BigFix Remote Control before 9.1.3 does not properly restrict failed login attempts, making it easier for remote attackers to gain access via a brute-force approach.
Original NVD description (English source)
IBM BigFix Remote Control before 9.1.3 does not properly restrict password choices, which makes it easier for remote attackers to obtain access via a brute-force approach.