CVE-2016-3130

An information disclosure vulnerability in the Core and Management Console in BlackBerry Enterprise Server (BES) 12 through 12.5.2 allows remote attackers to obtain local or domain credentials of an administrator or user account by sniffing traffic between the two elements during a login attempt.

CVSS v3.0 8.1 HIGH
CVSS v2.0 4.3 MEDIUM

8.1^/10

CVSS v3.0 : HIGH

Vector : AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability : 2.2 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

4.3^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:M/Au:N/C:P/I:N/A:N

Exploitability : 8.6 / Impact : 2.9

Access Vector NETWORK

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact NONE

Availability Impact NONE

References

Link	Resource
http://support.blackberry.com/kb/articleDetail?articleNumber=000038914
http://www.securitytracker.com/id/1037584
http://www.securityfocus.com/bid/95924

Advertisement

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:blackberry:enterprise_service:12.5.0a:::::::*
	cpe:2.3:a:blackberry:enterprise_service:12.4.1:::::::*
	cpe:2.3:a:blackberry:enterprise_service:12.0.0:::::::*
	cpe:2.3:a:blackberry:enterprise_service:12.5.2:::::::*
	cpe:2.3:a:blackberry:enterprise_service:12.5.1:::::::*
	cpe:2.3:a:blackberry:enterprise_service:12.1.0:::::::*
	cpe:2.3:a:blackberry:enterprise_service:12.0.1:::::::*
	cpe:2.3:a:blackberry:enterprise_service:12.2.1:::::::*
	cpe:2.3:a:blackberry:enterprise_service:12.2.0:::::::*
	cpe:2.3:a:blackberry:enterprise_service:12.4.0:::::::*
	cpe:2.3:a:blackberry:enterprise_service:12.3.1:::::::*
	cpe:2.3:a:blackberry:enterprise_service:12.3.0:::::::*

Information

Published : 2017-01-13 01:59

Updated : 2017-02-02 18:59

NVD link : CVE-2016-3130

Mitre link : CVE-2016-3130

JSON object : View

CWE

CWE-255

Credentials Management Errors

CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

Advertisement

Products Affected

blackberry

enterprise_service

{"cve": {"data_type": "CVE", "references": {"reference_data": [{"url": "http://support.blackberry.com/kb/articleDetail?articleNumber=000038914", "name": "http://support.blackberry.com/kb/articleDetail?articleNumber=000038914", "tags": [], "refsource": "CONFIRM"}, {"url": "http://www.securitytracker.com/id/1037584", "name": "1037584", "tags": [], "refsource": "SECTRACK"}, {"url": "http://www.securityfocus.com/bid/95924", "name": "95924", "tags": [], "refsource": "BID"}]}, "data_format": "MITRE", "description": {"description_data": [{"lang": "en", "value": "An information disclosure vulnerability in the Core and Management Console in BlackBerry Enterprise Server (BES) 12 through 12.5.2 allows remote attackers to obtain local or domain credentials of an administrator or user account by sniffing traffic between the two elements during a login attempt."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "en", "value": "CWE-255"}, {"lang": "en", "value": "CWE-200"}]}]}, "data_version": "4.0", "CVE_data_meta": {"ID": "CVE-2016-3130", "ASSIGNER": "secure@blackberry.com"}}, "impact": {"baseMetricV2": {"cvssV2": {"version": "2.0", "baseScore": 4.3, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:N/C:P/I:N/A:N", "authentication": "NONE", "integrityImpact": "NONE", "accessComplexity": "MEDIUM", "availabilityImpact": "NONE", "confidentialityImpact": "PARTIAL"}, "severity": "MEDIUM", "impactScore": 2.9, "obtainAllPrivilege": false, "exploitabilityScore": 8.6, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}, "baseMetricV3": {"cvssV3": {"scope": "UNCHANGED", "version": "3.0", "baseScore": 8.1, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.2}}, "publishedDate": "2017-01-13T09:59Z", "configurations": {"nodes": [{"children": [], "operator": "OR", "cpe_match": [{"cpe23Uri": "cpe:2.3:a:blackberry:enterprise_service:12.5.0a:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:blackberry:enterprise_service:12.4.1:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:blackberry:enterprise_service:12.0.0:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:blackberry:enterprise_service:12.5.2:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:blackberry:enterprise_service:12.5.1:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:blackberry:enterprise_service:12.1.0:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:blackberry:enterprise_service:12.0.1:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:blackberry:enterprise_service:12.2.1:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:blackberry:enterprise_service:12.2.0:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:blackberry:enterprise_service:12.4.0:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:blackberry:enterprise_service:12.3.1:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:blackberry:enterprise_service:12.3.0:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}]}], "CVE_data_version": "4.0"}, "lastModifiedDate": "2017-02-03T02:59Z"}