{
  "id": "CVE-2014-0841",
  "sourceIdentifier": "psirt@us.ibm.com",
  "published": "2018-04-27T16:29:00.550",
  "lastModified": "2018-06-07T18:00:01.510",
  "vulnStatus": "Analyzed",
  "descriptions": [
    {
      "lang": "en",
      "value": "IBM Rational Focal Point 6.4.0, 6.4.1, 6.5.1, 6.5.2, and 6.6.0 use a weak algorithm to hash passwords, which makes it easier for context-dependent attackers to obtain cleartext values via a brute-force attack. IBM X-Force ID: 90704."
    },
    {
      "lang": "es",
      "value": "IBM Rational Focal Point 6.4.0, 6.4.1, 6.5.1, 6.5.2 y 6.6.0 emplea un algoritmo d\u00e9bil para hashear contrase\u00f1as, lo que facilita que atacantes dependientes del contexto obtengan valores en texto claro mediante un ataque de fuerza bruta. IBM X-Force ID: 90704."
    }
  ],
  "metrics": {
    "cvssMetricV30": [
      {
        "source": "nvd@nist.gov",
        "type": "Primary",
        "cvssData": {
          "version": "3.0",
          "vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
          "attackVector": "LOCAL",
          "attackComplexity": "LOW",
          "privilegesRequired": "LOW",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "LOW",
          "integrityImpact": "LOW",
          "availabilityImpact": "LOW",
          "baseScore": 5.3,
          "baseSeverity": "MEDIUM"
        },
        "exploitabilityScore": 1.8,
        "impactScore": 3.4
      }
    ],
    "cvssMetricV2": [
      {
        "source": "nvd@nist.gov",
        "type": "Primary",
        "cvssData": {
          "version": "2.0",
          "vectorString": "AV:L/AC:L/Au:N/C:P/I:N/A:N",
          "accessVector": "LOCAL",
          "accessComplexity": "LOW",
          "authentication": "NONE",
          "confidentialityImpact": "PARTIAL",
          "integrityImpact": "NONE",
          "availabilityImpact": "NONE",
          "baseScore": 2.1
        },
        "baseSeverity": "LOW",
        "exploitabilityScore": 3.9,
        "impactScore": 2.9,
        "acInsufInfo": false,
        "obtainAllPrivilege": false,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ]
  },
  "weaknesses": [
    {
      "source": "nvd@nist.gov",
      "type": "Primary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-326"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:ibm:rational_focal_point:6.4:*:*:*:*:*:*:*",
              "matchCriteriaId": "46577E1B-77E6-4FE6-8B1F-F2A61FB0C15F"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:ibm:rational_focal_point:6.4.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "5E219FB1-DA55-4A16-B3ED-041D5AD6563D"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:ibm:rational_focal_point:6.5.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "5BF5FBBF-750D-49FF-97E8-91E9D29D53DA"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:ibm:rational_focal_point:6.5.2:*:*:*:*:*:*:*",
              "matchCriteriaId": "FD4F5963-909C-404E-AF58-885DBBC78FB2"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:ibm:rational_focal_point:6.6:*:*:*:*:*:*:*",
              "matchCriteriaId": "BDD57F9E-5569-4F38-8C1B-BF033498639E"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/90704",
      "source": "psirt@us.ibm.com",
      "tags": [
        "VDB Entry",
        "Vendor Advisory"
      ]
    },
    {
      "url": "https://www.ibm.com/blogs/psirt/ibm-security-bulletin-weak-password-hash-vulnerability-in-rational-focalpoint-cve-2014-0841/",
      "source": "psirt@us.ibm.com",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ]
    }
  ]
}