IBM Security Identity Manager Adapters 6.0 and 7.0 stores user credentials in plain in clear text which can be read by a local user.

Affected versions

NVD version ranges (for catalog products). Add the product to your stack with a version and matching uses these.

• ibm security identity manager6.0
• ibm security identity manager7.0

Versions reported by the vendor

Affected version ranges reported by the assigning authority (ibm). Independent of NVD's CPE analysis and usually ahead of it.

• IBM Security Identity Manager

  • 6.0, 7.0affected

Other highest-scoring records for the same primary product.

• CVE-2018-1969IBM Security Identity Manager 6.0.0 allows the attacker to upload or transfer files of dangerous types that can be automatically processed w
  40Plan
• CVE-2019-4675IBM Security Identity Manager 7.0.1 contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbo
  39Monitor
• CVE-2019-4561IBM Security Identity Manager 6.0.0 could allow a remote attacker to execute arbitrary code on the system, caused by the deserialization of
  36Monitor
• CVE-2018-1453IBM Security Identity Manager Virtual Appliance 7.0 allows an authenticated attacker to upload or transfer files of dangerous types that can
  36Monitor
• CVE-2021-29686IBM Security Identity Manager 7.0.2 could allow an authenticated user to bypass security and perform actions that they should not have acces
  35Monitor
• CVE-2016-0335Cross-site request forgery (CSRF) vulnerability in IBM Security Identity Manager (ISIM) Virtual Appliance 7.0.0.0 through 7.0.1.0 before 7.0
  35Monitor

FIRST EPSS daily score; only changes of 0.01 or more are recorded (step chart).

Attack context

MITRE CAPEC attack patterns and ATT&CK techniques for this weakness class (CWE). A starting point for detection rules and threat hunting.