CVE-2016-3034 Weak cryptography in AppScan Source
Local attackers can easily decrypt sensitive information due to unsalted one-way hashing in IBM AppScan Source.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2016-3034?
CVE-2016-3034 is a medium-severity vulnerability in IBM Corporation AppScan Source, published on 1 Feb 2017. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
IBM AppScan Source uses a one-way hash without salt to encrypt highly sensitive information, which could allow a local attacker to decrypt information more easily.
Weakness: CWE-326
Which versions are affected by CVE-2016-3034?
It affects 1 product.
Products include Ibm Security Appscan Source.
How do I fix CVE-2016-3034?
No fix has been published for CVE-2016-3034 yet. Limit exposure of the affected software until one is available.
Is CVE-2016-3034 being exploited?
There is no known exploitation of CVE-2016-3034 in the wild and no public exploit code.
Other vulnerabilities in IBM Corporation AppScan Source
Sources
Also known as GHSA-3qpw-79h9-q4jc.