CVE-2014-6176 Weak cryptography in n/a
Remote attackers can hijack sessions or read sensitive data because the server ignores SSL settings and forces weak SSLv3 protocol usage.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2014-6176?
CVE-2014-6176 is a medium-severity vulnerability in Ibm Business Process Manager, published on 16 Dec 2014. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
IBM WebSphere Process Server 7.0, WebSphere Enterprise Service Bus 7.0, and Business Process Manager Advanced 7.5.x through 7.5.1.2, 8.0.x through 8.0.1.3, and 8.5.x through 8.5.5 disregard the SSL setting in the SCA module HTTP import binding and unconditionally select the SSLv3 protocol, which makes it easier for remote attackers to hijack sessions or obtain sensitive information by leveraging the use of a weak cipher.
Weakness: CWE-310
Which versions are affected by CVE-2014-6176?
It affects 3 products.
Products include Ibm Business Process Manager, Ibm Websphere Enterprise Service Bus, Ibm Websphere Process Server.
How do I fix CVE-2014-6176?
No fix has been published for CVE-2014-6176 yet. Limit exposure of the affected software until one is available.
Is CVE-2014-6176 being exploited?
There is no known exploitation of CVE-2014-6176 in the wild and no public exploit code.
Other vulnerabilities in Ibm Business Process Manager
Sources
Also known as GHSA-fp8r-g5fc-7gx9.