Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2010-3318: IBM FileNet Content Manager sends passwords in cleartext

CVE-2010-3318 · published 16 years ago

Summary

Versions of IBM FileNet Content Manager before the 4.5.1.1-IER-FP001 update transmit user passwords without encryption. This means anyone who can watch the network traffic could read those passwords and gain access to sensitive information. Upgrade to the latest release or ensure the connection is protected with encryption to stop this exposure.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software

Vendor	Product	Affected versions
ibm	filenet_content_manager	4.5.0 4.5.1 `cpe:2.3:a:ibm:filenet_content_manager:4.5.0:::::::*`

Original advisory text

IBM Records Manager (RM) 4.5.x before 4.5.1.1-IER-FP001 transmits passwords in cleartext, which allows remote attackers to obtain sensitive information by sniffing the network.

References

http://secunia.com/advisories/41344 Vendor Advisory
http://www-01.ibm.com/support/docview.wss?uid=swg1PJ37426 Vendor Advisory
http://www.securityfocus.com/bid/43136

Fix within

Internet-facing 14 days

Internal 60 days

Not known to be exploited
Can be exploited automatically (estimated)
Gives an attacker partial control (estimated)

Severity

5.0 Medium

Exploitation

1% chance of attack within 30 days

Type

CWE-255Credentials Management Errors

Timeline

Published13 Sep 2010

Updated4 Nov 2026

First seen29 Sep 2026

Sources

CVE-2010-3318 · NVD

Track software like this

Free during beta