CVE-2016-6027

Published: Oct 6, 2016Modified: May 6, 2026

6.1

Vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Exploitability: 2.8 / Impact: 2.7

Source: NVD

Description

The Configuration Manager in IBM Sterling Secure Proxy (SSP) 3.4.2 before 3.4.2.0 iFix 8 and 3.4.3 before 3.4.3.0 iFix 1 does not enable the HSTS protection mechanism, which makes it easier for remote attackers to obtain sensitive information or modify data by leveraging use of HTTP.

Affected (9)

Products: Ibm: Sterling Secure Proxy

Ibm

1 product

Sterling Secure Proxy

Configuration A

9 vulnerable

Vulnerable Software	Affected Versions
Ibm Sterling Secure Proxy	Version 3.4.2.0
Ibm Sterling Secure Proxy	Version 3.4.2.0 ifix1
Ibm Sterling Secure Proxy	Version 3.4.2.0 ifix2
Ibm Sterling Secure Proxy	Version 3.4.2.0 ifix3
Ibm Sterling Secure Proxy	Version 3.4.2.0 ifix4
Ibm Sterling Secure Proxy	Version 3.4.2.0 ifix5
Ibm Sterling Secure Proxy	Version 3.4.2.0 ifix6
Ibm Sterling Secure Proxy	Version 3.4.2.0 ifix7
Ibm Sterling Secure Proxy	Version 3.4.3.0

Related CWEs

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

References (4)

http://www-01.ibm.com/support/docview.wss?uid=swg21991278

Source: psirt@us.ibm.com

Vendor Advisory

http://www.securityfocus.com/bid/93340

Source: psirt@us.ibm.com

http://www-01.ibm.com/support/docview.wss?uid=swg21991278

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

http://www.securityfocus.com/bid/93340

Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.