Vulnerability in IBM Algo Credit Limits
CVE-2014-0869
The decrypt function in RICOS in IBM Algo Credit Limits (aka ACLM) 4.5.0 through 4.7.0 before 4.7.0.03 FP5 in IBM Algorithmics does not require a key, which makes it easier for remote attackers to obtain cleartext passwords by sniffing the network and then providing a string argument to this function.
Vulnerability class: POODLE (CVE-2014-3566)
EPSS: 0.055 (91.9th percentile) — read the EPSS interpretation.
Affected products
- Ibm Algo_credit_limits — versions 4.5.0, 4.7.0
- Ibm Algorithmics
- N/a — versions n/a
Weakness classification (CWE)
References
- psirt@us.ibm.com (x_refsource_MISC)
- psirt@us.ibm.com (mailing-list, x_refsource_BUGTRAQ)
- psirt@us.ibm.com (x_refsource_CONFIRM, Vendor Advisory)
- psirt@us.ibm.com (vdb-entry, x_refsource_XF)
- psirt@us.ibm.com (x_refsource_MISC)
- psirt@us.ibm.com (mailing-list, x_refsource_FULLDISC)