CVE-2013-4035 json
IBM Sterling Connect:Direct for OpenVMS 3.4.00, 3.4.01, 3.5.00, 3.6.0, and 3.6.0.1 allow remote attackers to have unspecified impact by lev…
published 2018-05-01 8 y ago modified 2026-06-16 4 mo ago also EUVD-2013-3966
- cvss
- 7.3
- version 3.0, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.5%
- EPSS 0.5% chance of exploitation in 30 days, percentile 40%
- public exploits
- 0
- none known
Summary
IBM Sterling Connect:Direct for OpenVMS 3.4.00, 3.4.01, 3.5.00, 3.6.0, and 3.6.0.1 allow remote attackers to have unspecified impact by leveraging failure to reject client requests for an unencrypted session when used as the server in a TCP/IP session and configured for SSL encryption with the client. IBM X-Force ID: 86138.
Exploit prediction
0.46% chance of exploitation in the next 30 days, higher than 40% of all scored CVEs (FIRST EPSS, 2026-11-09).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 3.0 | 7.3 | CVSS:3.0/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N |
| NVD | 2.0 | 4.1 | AV:A/AC:L/Au:S/C:P/I:P/A:N |
Classification
- Weakness
-
- CWE-310 Cryptographic Issues
References
-
exchange.xforce.ibmcloud.com
/vulnerabilities/86138
vdb-entry, vendor-advisory
-
ibm.com
/blogs/psirt/security-bulletin-ibm-sterling-connectdirect-for-openvms-unencrypted-data-transfers-can-occur-eve
vendor-advisory
Sources
- CVE List CVE-2013-4035
- NVD CVE-2013-4035
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.