{"api_version":"1","generated_at":"2026-07-23T04:34:45+00:00","cve":"CVE-2017-1355","urls":{"html":"https://cve.report/CVE-2017-1355","api":"https://cve.report/api/cve/CVE-2017-1355.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2017-1355","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2017-1355"},"summary":{"title":"CVE-2017-1355","description":"IBM Atlas eDiscovery Process Management 6.0.3 stores sensitive information in URL parameters. This may lead to information disclosure if unauthorized parties have access to the URLs via server logs, referrer header or browser history. IBM X-Force ID: 126682.","state":"PUBLISHED","assigner":"ibm","published_at":"2017-12-07 15:29:00","updated_at":"2025-04-20 01:37:25"},"problem_types":["CWE-200","Obtain Information"],"metrics":[{"version":"3.0","source":"nvd@nist.gov","type":"Primary","score":"3.7","severity":"LOW","vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","data":{"version":"3.0","vectorString":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","baseScore":3.7,"baseSeverity":"LOW","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"}},{"version":"2.0","source":"nvd@nist.gov","type":"Primary","score":"4.3","severity":"","vector":"AV:N/AC:M/Au:N/C:P/I:N/A:N","data":{"version":"2.0","vectorString":"AV:N/AC:M/Au:N/C:P/I:N/A:N","baseScore":4.3,"accessVector":"NETWORK","accessComplexity":"MEDIUM","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"NONE","availabilityImpact":"NONE"}}],"references":[{"url":"http://www.securityfocus.com/bid/102016","name":"http://www.securityfocus.com/bid/102016","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory","VDB Entry"],"title":"IBM Atlas eDiscovery Process Management CVE-2017-1355 Information Disclosure Vulnerability","mime":"text/html","httpstatus":"200","archivestatus":"0"},{"url":"https://www.ibm.com/support/docview.wss?uid=swg22005836","name":"https://www.ibm.com/support/docview.wss?uid=swg22005836","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Issue Tracking","Vendor Advisory"],"title":"Security Bulletin: IBM Atlas eDiscovery Process Management affected by vulnerability due to sensitive information stored in URL parameters.","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/126682","name":"https://exchange.xforce.ibmcloud.com/vulnerabilities/126682","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Issue Tracking","VDB Entry","Vendor Advisory"],"title":"IBM X-Force Exchange","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://www.cve.org/CVERecord?id=CVE-2017-1355","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-1355","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"IBM","product":"Atlas eDiscovery Process Management","version":"affected 6.0.3","platforms":[]},{"source":"CNA","vendor":"IBM","product":"Atlas eDiscovery Process Management","version":"affected 6.0.3.2","platforms":[]},{"source":"CNA","vendor":"IBM","product":"Atlas eDiscovery Process Management","version":"affected 6.0.3.3","platforms":[]},{"source":"CNA","vendor":"IBM","product":"Atlas eDiscovery Process Management","version":"affected 6.0.3.4","platforms":[]},{"source":"CNA","vendor":"IBM","product":"Atlas eDiscovery Process Management","version":"affected 6.0.3.5","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2017","cve_id":"1355","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"ibm","cpe5":"atlas_ediscovery_process_management","cpe6":"6.0.3","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2017","cve_id":"1355","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"ibm","cpe5":"atlas_ediscovery_process_management","cpe6":"6.0.3.2","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2017","cve_id":"1355","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"ibm","cpe5":"atlas_ediscovery_process_management","cpe6":"6.0.3.3","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2017","cve_id":"1355","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"ibm","cpe5":"atlas_ediscovery_process_management","cpe6":"6.0.3.4","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2017","cve_id":"1355","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"ibm","cpe5":"atlas_ediscovery_process_management","cpe6":"6.0.3.5","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":{"cve_year":"2017","cve_id":"1355","cve":"CVE-2017-1355","epss":"0.001860000","percentile":"0.400570000","score_date":"2026-05-17","updated_at":"2026-05-18 00:00:13"},"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"adp":[{"providerMetadata":{"dateUpdated":"2024-08-05T13:32:29.355Z","orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE"},"references":[{"tags":["x_refsource_MISC","x_transferred"],"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/126682"},{"tags":["x_refsource_CONFIRM","x_transferred"],"url":"https://www.ibm.com/support/docview.wss?uid=swg22005836"},{"name":"102016","tags":["vdb-entry","x_refsource_BID","x_transferred"],"url":"http://www.securityfocus.com/bid/102016"}],"title":"CVE Program Container"}],"cna":{"affected":[{"product":"Atlas eDiscovery Process Management","vendor":"IBM","versions":[{"status":"affected","version":"6.0.3"},{"status":"affected","version":"6.0.3.2"},{"status":"affected","version":"6.0.3.3"},{"status":"affected","version":"6.0.3.4"},{"status":"affected","version":"6.0.3.5"}]}],"datePublic":"2017-07-14T00:00:00.000Z","descriptions":[{"lang":"en","value":"IBM Atlas eDiscovery Process Management 6.0.3 stores sensitive information in URL parameters. This may lead to information disclosure if unauthorized parties have access to the URLs via server logs, referrer header or browser history. IBM X-Force ID: 126682."}],"problemTypes":[{"descriptions":[{"description":"Obtain Information","lang":"en","type":"text"}]}],"providerMetadata":{"dateUpdated":"2017-12-08T10:57:01.000Z","orgId":"9a959283-ebb5-44b6-b705-dcc2bbced522","shortName":"ibm"},"references":[{"tags":["x_refsource_MISC"],"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/126682"},{"tags":["x_refsource_CONFIRM"],"url":"https://www.ibm.com/support/docview.wss?uid=swg22005836"},{"name":"102016","tags":["vdb-entry","x_refsource_BID"],"url":"http://www.securityfocus.com/bid/102016"}],"x_legacyV4Record":{"CVE_data_meta":{"ASSIGNER":"psirt@us.ibm.com","DATE_PUBLIC":"2017-07-14T00:00:00","ID":"CVE-2017-1355","STATE":"PUBLIC"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"Atlas eDiscovery Process Management","version":{"version_data":[{"version_value":"6.0.3"},{"version_value":"6.0.3.2"},{"version_value":"6.0.3.3"},{"version_value":"6.0.3.4"},{"version_value":"6.0.3.5"}]}}]},"vendor_name":"IBM"}]}},"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"IBM Atlas eDiscovery Process Management 6.0.3 stores sensitive information in URL parameters. This may lead to information disclosure if unauthorized parties have access to the URLs via server logs, referrer header or browser history. IBM X-Force ID: 126682."}]},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"Obtain Information"}]}]},"references":{"reference_data":[{"name":"https://exchange.xforce.ibmcloud.com/vulnerabilities/126682","refsource":"MISC","url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/126682"},{"name":"https://www.ibm.com/support/docview.wss?uid=swg22005836","refsource":"CONFIRM","url":"https://www.ibm.com/support/docview.wss?uid=swg22005836"},{"name":"102016","refsource":"BID","url":"http://www.securityfocus.com/bid/102016"}]}}}},"cveMetadata":{"assignerOrgId":"9a959283-ebb5-44b6-b705-dcc2bbced522","assignerShortName":"ibm","cveId":"CVE-2017-1355","datePublished":"2017-12-07T15:00:00.000Z","dateReserved":"2016-11-30T00:00:00.000Z","dateUpdated":"2024-09-17T03:03:01.088Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.1"},"nvd":{"publishedDate":"2017-12-07 15:29:00","lastModifiedDate":"2025-04-20 01:37:25","problem_types":["CWE-200","Obtain Information"],"metrics":{"cvssMetricV30":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.0","vectorString":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","baseScore":3.7,"baseSeverity":"LOW","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.2,"impactScore":1.4}],"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:M/Au:N/C:P/I:N/A:N","baseScore":4.3,"accessVector":"NETWORK","accessComplexity":"MEDIUM","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"NONE","availabilityImpact":"NONE"},"baseSeverity":"MEDIUM","exploitabilityScore":8.6,"impactScore":2.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}]},"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:ibm:atlas_ediscovery_process_management:6.0.3:*:*:*:*:*:*:*","matchCriteriaId":"73E3A3C8-7B7C-4BC8-B3BF-B5AE24E6B725"},{"vulnerable":true,"criteria":"cpe:2.3:a:ibm:atlas_ediscovery_process_management:6.0.3.2:*:*:*:*:*:*:*","matchCriteriaId":"C2EF447D-F279-49AF-9F94-8044FF1ADF35"},{"vulnerable":true,"criteria":"cpe:2.3:a:ibm:atlas_ediscovery_process_management:6.0.3.3:*:*:*:*:*:*:*","matchCriteriaId":"EED72F10-0F20-473B-B2DC-F3F3214FC5E6"},{"vulnerable":true,"criteria":"cpe:2.3:a:ibm:atlas_ediscovery_process_management:6.0.3.4:*:*:*:*:*:*:*","matchCriteriaId":"240398E0-2B39-402C-8B4B-1B114D260252"},{"vulnerable":true,"criteria":"cpe:2.3:a:ibm:atlas_ediscovery_process_management:6.0.3.5:*:*:*:*:*:*:*","matchCriteriaId":"1EA5CE00-DFF6-40DE-99B8-A4161BB4A23A"}]}]}]},"legacy_mitre":{"record":{"CveYear":"2017","CveId":"1355","Ordinal":"1","Title":"CVE-2017-1355","CVE":"CVE-2017-1355","Year":"2017"},"notes":[{"CveYear":"2017","CveId":"1355","Ordinal":"1","NoteData":"IBM Atlas eDiscovery Process Management 6.0.3 stores sensitive information in URL parameters. This may lead to information disclosure if unauthorized parties have access to the URLs via server logs, referrer header or browser history. IBM X-Force ID: 126682.","Type":"Description","Title":"CVE-2017-1355"},{"CveYear":"2017","CveId":"1355","Ordinal":"2","NoteData":"2017-12-07","Type":"Other","Title":"Published"},{"CveYear":"2017","CveId":"1355","Ordinal":"3","NoteData":"2017-12-08","Type":"Other","Title":"Modified"}]}}}