CVE-2016-0297 Information disclosure in BigFix Platform

Low 3.7 Published 1 Feb 2017 Updated 5 Aug 2024

Remote attackers can intercept sensitive data via man-in-the-middle attacks due to missing HSTS headers in IBM BigFix MDM.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2016-0297?

CVE-2016-0297 is a low-severity vulnerability in IBM Corporation BigFix Platform, published on 1 Feb 2017. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

IBM Tivoli Endpoint Manager - Mobile Device Management (MDM) could allow a remote attacker to obtain sensitive information due to a missing HTTP Strict-Transport-Security Header through man in the middle techniques.

Weakness: CWE-200

Which versions are affected by CVE-2016-0297?

It affects 1 product.

Products include Ibm Bigfix Platform.

How do I fix CVE-2016-0297?

No fix has been published for CVE-2016-0297 yet. Limit exposure of the affected software until one is available.

Is CVE-2016-0297 being exploited?

There is no known exploitation of CVE-2016-0297 in the wild and no public exploit code.

Sources

Also known as GHSA-5jpj-wxw3-jrpj.