{"api_version":"1","generated_at":"2026-07-23T03:12:48+00:00","cve":"CVE-2016-5958","urls":{"html":"https://cve.report/CVE-2016-5958","api":"https://cve.report/api/cve/CVE-2016-5958.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2016-5958","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2016-5958"},"summary":{"title":"CVE-2016-5958","description":"IBM Security Privileged Identity Manager could allow a remote attacker to obtain sensitive information, caused by the failure to set the secure flag for the session cookie in SSL mode. By intercepting its transmission within an HTTP session, an attacker could exploit this vulnerability to capture the cookie and obtain sensitive information.","state":"PUBLISHED","assigner":"ibm","published_at":"2017-02-01 20:59:01","updated_at":"2025-04-20 01:37:25"},"problem_types":["CWE-200","Obtain Information"],"metrics":[{"version":"3.0","source":"nvd@nist.gov","type":"Primary","score":"7.5","severity":"HIGH","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","data":{"version":"3.0","vectorString":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"}},{"version":"2.0","source":"nvd@nist.gov","type":"Primary","score":"5","severity":"","vector":"AV:N/AC:L/Au:N/C:P/I:N/A:N","data":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:P/I:N/A:N","baseScore":5,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"NONE","availabilityImpact":"NONE"}}],"references":[{"url":"http://www.securityfocus.com/bid/95196","name":"http://www.securityfocus.com/bid/95196","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory","VDB Entry"],"title":"IBM Security Privileged Identity Manager CVE-2016-5958 Information Disclosure Vulnerability","mime":"text/html","httpstatus":"200","archivestatus":"0"},{"url":"http://www.ibm.com/support/docview.wss?uid=swg21996614","name":"http://www.ibm.com/support/docview.wss?uid=swg21996614","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Patch","Vendor Advisory"],"title":"IBM Security Bulletin: Multiple Security Vulnerabilities affect IBM Security Privileged Identity Manager Virtual Appliance - United States","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-5958","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-5958","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"IBM Corporation","product":"Privileged Identity Manager","version":"affected 1.0.1","platforms":[]},{"source":"CNA","vendor":"IBM Corporation","product":"Privileged Identity Manager","version":"affected 1.0.1.1","platforms":[]},{"source":"CNA","vendor":"IBM Corporation","product":"Privileged Identity Manager","version":"affected 2.0.0","platforms":[]},{"source":"CNA","vendor":"IBM Corporation","product":"Privileged Identity Manager","version":"affected 2.0.1","platforms":[]},{"source":"CNA","vendor":"IBM Corporation","product":"Privileged Identity Manager","version":"affected 2.0.2","platforms":[]},{"source":"CNA","vendor":"IBM Corporation","product":"Privileged Identity Manager","version":"affected 2.1.0","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2016","cve_id":"5958","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"ibm","cpe5":"security_privileged_identity_manager","cpe6":"2.0.2","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2016","cve_id":"5958","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"ibm","cpe5":"security_privileged_identity_manager","cpe6":"2.1","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"adp":[{"providerMetadata":{"dateUpdated":"2024-08-06T01:15:10.837Z","orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE"},"references":[{"tags":["x_refsource_CONFIRM","x_transferred"],"url":"http://www.ibm.com/support/docview.wss?uid=swg21996614"},{"name":"95196","tags":["vdb-entry","x_refsource_BID","x_transferred"],"url":"http://www.securityfocus.com/bid/95196"}],"title":"CVE Program Container"}],"cna":{"affected":[{"product":"Privileged Identity Manager","vendor":"IBM Corporation","versions":[{"status":"affected","version":"1.0.1"},{"status":"affected","version":"1.0.1.1"},{"status":"affected","version":"2.0.0"},{"status":"affected","version":"2.0.1"},{"status":"affected","version":"2.0.2"},{"status":"affected","version":"2.1.0"}]}],"datePublic":"2017-02-01T00:00:00.000Z","descriptions":[{"lang":"en","value":"IBM Security Privileged Identity Manager could allow a remote attacker to obtain sensitive information, caused by the failure to set the secure flag for the session cookie in SSL mode. By intercepting its transmission within an HTTP session, an attacker could exploit this vulnerability to capture the cookie and obtain sensitive information."}],"problemTypes":[{"descriptions":[{"description":"Obtain Information","lang":"en","type":"text"}]}],"providerMetadata":{"dateUpdated":"2017-02-02T10:57:01.000Z","orgId":"9a959283-ebb5-44b6-b705-dcc2bbced522","shortName":"ibm"},"references":[{"tags":["x_refsource_CONFIRM"],"url":"http://www.ibm.com/support/docview.wss?uid=swg21996614"},{"name":"95196","tags":["vdb-entry","x_refsource_BID"],"url":"http://www.securityfocus.com/bid/95196"}],"x_legacyV4Record":{"CVE_data_meta":{"ASSIGNER":"psirt@us.ibm.com","ID":"CVE-2016-5958","STATE":"PUBLIC"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"Privileged Identity Manager","version":{"version_data":[{"version_value":"1.0.1"},{"version_value":"1.0.1.1"},{"version_value":"2.0.0"},{"version_value":"2.0.1"},{"version_value":"2.0.2"},{"version_value":"2.1.0"}]}}]},"vendor_name":"IBM Corporation"}]}},"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"IBM Security Privileged Identity Manager could allow a remote attacker to obtain sensitive information, caused by the failure to set the secure flag for the session cookie in SSL mode. By intercepting its transmission within an HTTP session, an attacker could exploit this vulnerability to capture the cookie and obtain sensitive information."}]},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"Obtain Information"}]}]},"references":{"reference_data":[{"name":"http://www.ibm.com/support/docview.wss?uid=swg21996614","refsource":"CONFIRM","url":"http://www.ibm.com/support/docview.wss?uid=swg21996614"},{"name":"95196","refsource":"BID","url":"http://www.securityfocus.com/bid/95196"}]}}}},"cveMetadata":{"assignerOrgId":"9a959283-ebb5-44b6-b705-dcc2bbced522","assignerShortName":"ibm","cveId":"CVE-2016-5958","datePublished":"2017-02-01T20:00:00.000Z","dateReserved":"2016-06-29T00:00:00.000Z","dateUpdated":"2024-08-06T01:15:10.837Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.1"},"nvd":{"publishedDate":"2017-02-01 20:59:01","lastModifiedDate":"2025-04-20 01:37:25","problem_types":["CWE-200","Obtain Information"],"metrics":{"cvssMetricV30":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.0","vectorString":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":3.6}],"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:P/I:N/A:N","baseScore":5,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"NONE","availabilityImpact":"NONE"},"baseSeverity":"MEDIUM","exploitabilityScore":10,"impactScore":2.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}]},"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:ibm:security_privileged_identity_manager:2.0.2:*:*:*:*:*:*:*","matchCriteriaId":"D07547A7-E87E-4085-983F-29BD485E3160"},{"vulnerable":true,"criteria":"cpe:2.3:a:ibm:security_privileged_identity_manager:2.1:*:*:*:*:*:*:*","matchCriteriaId":"8C26B4C2-D6EC-4367-9D59-BE9FF8DC2395"}]}]}]},"legacy_mitre":{"record":{"CveYear":"2016","CveId":"5958","Ordinal":"1","Title":"CVE-2016-5958","CVE":"CVE-2016-5958","Year":"2016"},"notes":[{"CveYear":"2016","CveId":"5958","Ordinal":"1","NoteData":"IBM Security Privileged Identity Manager could allow a remote attacker to obtain sensitive information, caused by the failure to set the secure flag for the session cookie in SSL mode. By intercepting its transmission within an HTTP session, an attacker could exploit this vulnerability to capture the cookie and obtain sensitive information.","Type":"Description","Title":"CVE-2016-5958"},{"CveYear":"2016","CveId":"5958","Ordinal":"2","NoteData":"2017-02-01","Type":"Other","Title":"Published"},{"CveYear":"2016","CveId":"5958","Ordinal":"3","NoteData":"2017-02-02","Type":"Other","Title":"Modified"}]}}}