CVE-2016-2884

Опубликовано: 30 нояб. 2016

Источник: nvd

CVSS3: 8

CVSS2: 6

EPSS Низкий

Описание

Cross-site request forgery (CSRF) vulnerability in IBM Forms Experience Builder 8.5.x and 8.6.x before 8.6.3.1, in an unspecified non-default configuration, allows remote authenticated users to hijack the authentication of arbitrary users for requests that insert XSS sequences.

Ссылки

http://www-01.ibm.com/support/docview.wss?uid=swg1LO89686
Not Applicable
http://www-01.ibm.com/support/docview.wss?uid=swg21987252
Patch
Vendor Advisory
http://www-01.ibm.com/support/docview.wss?uid=swg1LO89686
Not Applicable
http://www-01.ibm.com/support/docview.wss?uid=swg21987252
Patch
Vendor Advisory

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:ibm:forms_experience_builder:8.5.0.0:*:*:*:*:*:*:*

cpe:2.3:a:ibm:forms_experience_builder:8.5.1.0:*:*:*:*:*:*:*

cpe:2.3:a:ibm:forms_experience_builder:8.5.1.1:*:*:*:*:*:*:*

cpe:2.3:a:ibm:forms_experience_builder:8.6.0.0:*:*:*:*:*:*:*

cpe:2.3:a:ibm:forms_experience_builder:8.6.1:*:*:*:*:*:*:*

cpe:2.3:a:ibm:forms_experience_builder:8.6.1.1:*:*:*:*:*:*:*

cpe:2.3:a:ibm:forms_experience_builder:8.6.2:*:*:*:*:*:*:*

cpe:2.3:a:ibm:forms_experience_builder:8.6.2.1:*:*:*:*:*:*:*

cpe:2.3:a:ibm:forms_experience_builder:8.6.3:*:*:*:*:*:*:*

EPSS

Процентиль: 27%

0.00096

Низкий

8 High

CVSS3

6 Medium

CVSS2

Дефекты

CWE-352

Связанные уязвимости

GHSA-46f8-px2p-h7p6