CVE-2016-3004

Опубликовано: 30 нояб. 2016

Источник: nvd

CVSS3: 4.6

CVSS2: 4.9

EPSS Низкий

Описание

Cross-site request forgery (CSRF) vulnerability in IBM Connections 4.0 through CR4, 4.5 through CR5, and 5.0 before CR4 allows remote authenticated users to hijack the authentication of arbitrary users for requests that modify the set of available applications.

Ссылки

http://www-01.ibm.com/support/docview.wss?uid=swg1LO90039
Broken Link
http://www-01.ibm.com/support/docview.wss?uid=swg21990864
Patch
Vendor Advisory
http://www.securityfocus.com/bid/94332
Third Party Advisory
VDB Entry
http://www-01.ibm.com/support/docview.wss?uid=swg1LO90039
Broken Link
http://www-01.ibm.com/support/docview.wss?uid=swg21990864
Patch
Vendor Advisory
http://www.securityfocus.com/bid/94332
Third Party Advisory
VDB Entry

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:ibm:connections:4.0.0.0:*:*:*:*:*:*:*

cpe:2.3:a:ibm:connections:4.5.0.0:*:*:*:*:*:*:*

cpe:2.3:a:ibm:connections:5.0.0.0:*:*:*:*:*:*:*

EPSS

Процентиль: 22%

0.00072

Низкий

4.6 Medium

CVSS3

4.9 Medium

CVSS2

Дефекты

CWE-352

Связанные уязвимости

GHSA-772j-xw3h-f4ph