CVE-2016-3130

moderate-risk

Published 2017-01-13

An information disclosure vulnerability in the Core and Management Console in BlackBerry Enterprise Server (BES) 12 through 12.5.2 allows remote attackers to obtain local or domain credentials of an administrator or user account by sniffing traffic between the two elements during a login attempt.

Do I need to act?

0.34% chance of exploitation

EPSS score — low exploit probability

Not on CISA KEV list

No confirmed active exploitation reported to CISA

Patch status unknown

Check vendor advisories for fix availability and mitigation guidance

CVSS 8.1/10 High

NETWORK / HIGH complexity

Affected Products (12)

Enterprise Service

Affected Vendors

Blackberry

References (6)

http://support.blackberry.com/kb/articleDetail?articleNumber=000038914

http://www.securityfocus.com/bid/95924

http://www.securitytracker.com/id/1037584

http://support.blackberry.com/kb/articleDetail?articleNumber=000038914

http://www.securityfocus.com/bid/95924

http://www.securitytracker.com/id/1037584

/ 100

moderate-risk

Severity 24/34 · High

Exploitability 1/34 · Minimal

Exposure 17/34 · Moderate