CVE-2014-6111 Information disclosure in n/a
Local attackers can read cleartext credentials and keystore passwords from configuration files in IBM Identity Manager products.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2014-6111?
CVE-2014-6111 is a high-severity vulnerability in n/a, published on 20 Apr 2018. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
IBM Tivoli Identity Manager 5.1.x before 5.1.0.15-ISS-TIM-IF0057 and Security Identity Manager 6.0.x before 6.0.0.4-ISS-SIM-IF0001 and 7.0.x before 7.0.0.0-ISS-SIM-IF0003 store encrypted user credentials and the keystore password in cleartext in configuration files, which allows local users to decrypt SIM credentials via unspecified vectors. IBM X-Force ID: 96180.
Weakness: CWE-255
Which versions are affected by CVE-2014-6111?
It affects 2 products.
Products include Ibm Security Identity Manager, Ibm Tivoli Identity Manager.
How do I fix CVE-2014-6111?
No fix has been published for CVE-2014-6111 yet. Limit exposure of the affected software until one is available.
Is CVE-2014-6111 being exploited?
There is no known exploitation of CVE-2014-6111 in the wild and no public exploit code.
Other vulnerabilities in n/a
Sources
Also known as GHSA-pcqg-2gmg-j67j.