CVE-2013-4035

Severity: high (CVSS 7.3 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.5% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2018-05-01 · updated 2026-06-16
Weakness: CWE-310

Description

IBM Sterling Connect:Direct for OpenVMS 3.4.00, 3.4.01, 3.5.00, 3.6.0, and 3.6.0.1 allow remote attackers to have unspecified impact by leveraging failure to reject client requests for an unencrypted session when used as the server in a TCP/IP session and configured for SSL encryption with the client. IBM X-Force ID: 86138.

Affected products

IBM Sterling Connect: 3.4.0.0, 3.4.0.1, 3.5.0.0, 3.6.0, 3.6.0.1

References

https://exchange.xforce.ibmcloud.com/vulnerabilities/86138
https://www.ibm.com/blogs/psirt/security-bulletin-ibm-sterling-connectdirect-for-openvms-unencrypted-data-transfers-can-occur-even-when-ssl-encryption-is-specified-in-the-security-configuration-cve-2013-4035/
https://exchange.xforce.ibmcloud.com/vulnerabilities/86138
https://www.ibm.com/blogs/psirt/security-bulletin-ibm-sterling-connectdirect-for-openvms-unencrypted-data-transfers-can-occur-even-when-ssl-encryption-is-specified-in-the-security-configuration-cve-2013-4035/

Get alerted when CVE-2013-4035 or the next vulnerability affects your stack