CVE-2014-6176

Severity: medium (CVSS 4.3 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.8% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2014-12-16 · updated 2026-06-17
Weakness: CWE-310

Description

IBM WebSphere Process Server 7.0, WebSphere Enterprise Service Bus 7.0, and Business Process Manager Advanced 7.5.x through 7.5.1.2, 8.0.x through 8.0.1.3, and 8.5.x through 8.5.5 disregard the SSL setting in the SCA module HTTP import binding and unconditionally select the SSLv3 protocol, which makes it easier for remote attackers to hijack sessions or obtain sensitive information by leveraging the use of a weak cipher.

Affected products

IBM Business Process Manager: 7.5.0.0, 7.5.0.1, 7.5.1.0, 7.5.1.1, 8.0.0.0, 8.0.1.0 (+6)
IBM Websphere Enterprise Service Bus: 7.0
IBM Websphere Process Server: 7.0

References

http://www-01.ibm.com/support/docview.wss?uid=swg1JR51593
http://www-01.ibm.com/support/docview.wss?uid=swg21690780
http://www.securitytracker.com/id/1031382
http://www.securitytracker.com/id/1031383
https://exchange.xforce.ibmcloud.com/vulnerabilities/98488
http://www-01.ibm.com/support/docview.wss?uid=swg1JR51593
http://www-01.ibm.com/support/docview.wss?uid=swg21690780
http://www.securitytracker.com/id/1031382
http://www.securitytracker.com/id/1031383
https://exchange.xforce.ibmcloud.com/vulnerabilities/98488

Get alerted when CVE-2014-6176 or the next vulnerability affects your stack