{"api_version":"1","generated_at":"2026-07-23T09:25:53+00:00","cve":"CVE-2016-5966","urls":{"html":"https://cve.report/CVE-2016-5966","api":"https://cve.report/api/cve/CVE-2016-5966.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2016-5966","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2016-5966"},"summary":{"title":"CVE-2016-5966","description":"IBM Security Privileged Identity Manager Virtual Appliance could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable HTTP Strict Transport Security. An attacker could exploit this vulnerability to obtain sensitive information using man in the middle techniques.","state":"PUBLISHED","assigner":"ibm","published_at":"2017-02-01 20:59:01","updated_at":"2025-04-20 01:37:25"},"problem_types":["CWE-200","Obtain Information"],"metrics":[{"version":"3.0","source":"nvd@nist.gov","type":"Primary","score":"5.9","severity":"MEDIUM","vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","data":{"version":"3.0","vectorString":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","baseScore":5.9,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"}},{"version":"2.0","source":"nvd@nist.gov","type":"Primary","score":"4.3","severity":"","vector":"AV:N/AC:M/Au:N/C:P/I:N/A:N","data":{"version":"2.0","vectorString":"AV:N/AC:M/Au:N/C:P/I:N/A:N","baseScore":4.3,"accessVector":"NETWORK","accessComplexity":"MEDIUM","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"NONE","availabilityImpact":"NONE"}}],"references":[{"url":"http://www.securityfocus.com/bid/95197","name":"http://www.securityfocus.com/bid/95197","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory","VDB Entry"],"title":"IBM Security Privileged Identity Manager CVE-2016-5966 Information Disclosure Vulnerability","mime":"text/html","httpstatus":"200","archivestatus":"0"},{"url":"http://www.ibm.com/support/docview.wss?uid=swg21996614","name":"http://www.ibm.com/support/docview.wss?uid=swg21996614","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Patch","Vendor Advisory"],"title":"IBM Security Bulletin: Multiple Security Vulnerabilities affect IBM Security Privileged Identity Manager Virtual Appliance - United States","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-5966","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-5966","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"IBM Corporation","product":"Privileged Identity Manager","version":"affected 1.0.1","platforms":[]},{"source":"CNA","vendor":"IBM Corporation","product":"Privileged Identity Manager","version":"affected 1.0.1.1","platforms":[]},{"source":"CNA","vendor":"IBM Corporation","product":"Privileged Identity Manager","version":"affected 2.0.0","platforms":[]},{"source":"CNA","vendor":"IBM Corporation","product":"Privileged Identity Manager","version":"affected 2.0.1","platforms":[]},{"source":"CNA","vendor":"IBM Corporation","product":"Privileged Identity Manager","version":"affected 2.0.2","platforms":[]},{"source":"CNA","vendor":"IBM Corporation","product":"Privileged Identity Manager","version":"affected 2.1.0","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2016","cve_id":"5966","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"ibm","cpe5":"security_privileged_identity_manager","cpe6":"2.0.2","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2016","cve_id":"5966","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"ibm","cpe5":"security_privileged_identity_manager","cpe6":"2.1","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"adp":[{"providerMetadata":{"dateUpdated":"2024-08-06T01:15:10.889Z","orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE"},"references":[{"tags":["x_refsource_CONFIRM","x_transferred"],"url":"http://www.ibm.com/support/docview.wss?uid=swg21996614"},{"name":"95197","tags":["vdb-entry","x_refsource_BID","x_transferred"],"url":"http://www.securityfocus.com/bid/95197"}],"title":"CVE Program Container"}],"cna":{"affected":[{"product":"Privileged Identity Manager","vendor":"IBM Corporation","versions":[{"status":"affected","version":"1.0.1"},{"status":"affected","version":"1.0.1.1"},{"status":"affected","version":"2.0.0"},{"status":"affected","version":"2.0.1"},{"status":"affected","version":"2.0.2"},{"status":"affected","version":"2.1.0"}]}],"datePublic":"2017-02-01T00:00:00.000Z","descriptions":[{"lang":"en","value":"IBM Security Privileged Identity Manager Virtual Appliance could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable HTTP Strict Transport Security. An attacker could exploit this vulnerability to obtain sensitive information using man in the middle techniques."}],"problemTypes":[{"descriptions":[{"description":"Obtain Information","lang":"en","type":"text"}]}],"providerMetadata":{"dateUpdated":"2017-02-02T10:57:01.000Z","orgId":"9a959283-ebb5-44b6-b705-dcc2bbced522","shortName":"ibm"},"references":[{"tags":["x_refsource_CONFIRM"],"url":"http://www.ibm.com/support/docview.wss?uid=swg21996614"},{"name":"95197","tags":["vdb-entry","x_refsource_BID"],"url":"http://www.securityfocus.com/bid/95197"}],"x_legacyV4Record":{"CVE_data_meta":{"ASSIGNER":"psirt@us.ibm.com","ID":"CVE-2016-5966","STATE":"PUBLIC"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"Privileged Identity Manager","version":{"version_data":[{"version_value":"1.0.1"},{"version_value":"1.0.1.1"},{"version_value":"2.0.0"},{"version_value":"2.0.1"},{"version_value":"2.0.2"},{"version_value":"2.1.0"}]}}]},"vendor_name":"IBM Corporation"}]}},"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"IBM Security Privileged Identity Manager Virtual Appliance could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable HTTP Strict Transport Security. An attacker could exploit this vulnerability to obtain sensitive information using man in the middle techniques."}]},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"Obtain Information"}]}]},"references":{"reference_data":[{"name":"http://www.ibm.com/support/docview.wss?uid=swg21996614","refsource":"CONFIRM","url":"http://www.ibm.com/support/docview.wss?uid=swg21996614"},{"name":"95197","refsource":"BID","url":"http://www.securityfocus.com/bid/95197"}]}}}},"cveMetadata":{"assignerOrgId":"9a959283-ebb5-44b6-b705-dcc2bbced522","assignerShortName":"ibm","cveId":"CVE-2016-5966","datePublished":"2017-02-01T20:00:00.000Z","dateReserved":"2016-06-29T00:00:00.000Z","dateUpdated":"2024-08-06T01:15:10.889Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.1"},"nvd":{"publishedDate":"2017-02-01 20:59:01","lastModifiedDate":"2025-04-20 01:37:25","problem_types":["CWE-200","Obtain Information"],"metrics":{"cvssMetricV30":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.0","vectorString":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","baseScore":5.9,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.2,"impactScore":3.6}],"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:M/Au:N/C:P/I:N/A:N","baseScore":4.3,"accessVector":"NETWORK","accessComplexity":"MEDIUM","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"NONE","availabilityImpact":"NONE"},"baseSeverity":"MEDIUM","exploitabilityScore":8.6,"impactScore":2.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}]},"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:ibm:security_privileged_identity_manager:2.0.2:*:*:*:*:*:*:*","matchCriteriaId":"D07547A7-E87E-4085-983F-29BD485E3160"},{"vulnerable":true,"criteria":"cpe:2.3:a:ibm:security_privileged_identity_manager:2.1:*:*:*:*:*:*:*","matchCriteriaId":"8C26B4C2-D6EC-4367-9D59-BE9FF8DC2395"}]}]}]},"legacy_mitre":{"record":{"CveYear":"2016","CveId":"5966","Ordinal":"1","Title":"CVE-2016-5966","CVE":"CVE-2016-5966","Year":"2016"},"notes":[{"CveYear":"2016","CveId":"5966","Ordinal":"1","NoteData":"IBM Security Privileged Identity Manager Virtual Appliance could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable HTTP Strict Transport Security. An attacker could exploit this vulnerability to obtain sensitive information using man in the middle techniques.","Type":"Description","Title":"CVE-2016-5966"},{"CveYear":"2016","CveId":"5966","Ordinal":"2","NoteData":"2017-02-01","Type":"Other","Title":"Published"},{"CveYear":"2016","CveId":"5966","Ordinal":"3","NoteData":"2017-02-02","Type":"Other","Title":"Modified"}]}}}