CVE-2016-2936
HighSummary
IBM BigFix Remote Control before version 9.1.3 uses cleartext storage for passwords, allowing local users to obtain sensitive information.
Risk Assessment
Storing passwords in cleartext poses a risk of unauthorized access to sensitive data by local users.
Recommendation
It is recommended to upgrade to version 9.1.3 or later and implement encryption mechanisms for stored passwords.
Other vulnerabilities in IBM BigFix Remote Control
See all- CVE-2016-2930High
IBM BigFix Remote Control version 9.1.3 could allow a remote attacker to perform actions reserved for an administrator without authentication.
- CVE-2016-2963High
CVE-2016-2963 is a CSRF vulnerability in IBM BigFix Remote Control before version 9.1.3 that allows remote attackers to hijack the authentication of arbitrary users for requests that insert XSS sequences.
- CVE-2016-2948High
IBM BigFix Remote Control before 9.1.3 allows local users to discover hardcoded credentials via unspecified vectors.
- CVE-2016-2929High
IBM BigFix Remote Control before 9.1.3 does not properly restrict password choices, which makes it easier for remote attackers to obtain access via a brute-force approach.
- CVE-2016-2944Critical
IBM BigFix Remote Control before 9.1.3 does not properly restrict failed login attempts, making it easier for remote attackers to gain access via a brute-force approach.
Original NVD description (English source)
IBM BigFix Remote Control before 9.1.3 uses cleartext storage for unspecified passwords, which allows local users to obtain sensitive information via unknown vectors.