CVE-2013-3046

Published: May 26, 2014Modified: May 6, 2026

4.3

Vector

AV:A/AC:M/Au:N/C:P/I:P/A:N

Exploitability: 5.5 / Impact: 4.9

Source: NVD

Description

The Meeting Server in IBM Sametime 8.x through 8.5.2.1 and 9.x through 9.0.0.1 does not send the HSTS Strict-Transport-Security header, which makes it easier for man-in-the-middle attackers to hijack sessions or obtain sensitive information by leveraging the presence of HTTP requests.

Affected (12)

Products: Ibm: Sametime

Ibm

1 product

Sametime

Configuration A

12 vulnerable

Vulnerable Software	Affected Versions
Ibm Sametime	Version 8.0.0.0
Ibm Sametime	Version 8.0.1.0
Ibm Sametime	Version 8.0.1.1
Ibm Sametime	Version 8.0.2.0
Ibm Sametime	Version 8.0.2.1
Ibm Sametime	Version 8.5.0.0
Ibm Sametime	Version 8.5.1.0
Ibm Sametime	Version 8.5.1.1
Ibm Sametime	Version 8.5.2.0
Ibm Sametime	Version 8.5.2.1
Ibm Sametime	Version 9.0.0.0
Ibm Sametime	Version 9.0.0.1

Related CWEs

CWE-287

Improper Authentication

When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

References (4)

http://www-01.ibm.com/support/docview.wss?uid=swg21671201

Source: psirt@us.ibm.com

Vendor Advisory

https://exchange.xforce.ibmcloud.com/vulnerabilities/84819

Source: psirt@us.ibm.com

http://www-01.ibm.com/support/docview.wss?uid=swg21671201

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

https://exchange.xforce.ibmcloud.com/vulnerabilities/84819

Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.