CVE-2016-3009

Опубликовано: 30 нояб. 2016

Источник: nvd

CVSS3: 3.5

CVSS2: 3.5

EPSS Низкий

Описание

Cross-site request forgery (CSRF) vulnerability in IBM Connections 4.0 through CR4, 4.5 through CR5, and 5.0 before CR4 allows remote authenticated users to hijack the authentication of arbitrary users for requests that modify the Connections generic page.

Ссылки

http://www-01.ibm.com/support/docview.wss?uid=swg1LO90039
Broken Link
http://www-01.ibm.com/support/docview.wss?uid=swg21990864
Vendor Advisory
http://www.securityfocus.com/bid/94329
Third Party Advisory
VDB Entry
http://www-01.ibm.com/support/docview.wss?uid=swg1LO90039
Broken Link
http://www-01.ibm.com/support/docview.wss?uid=swg21990864
Vendor Advisory
http://www.securityfocus.com/bid/94329
Third Party Advisory
VDB Entry

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:ibm:connections:4.0.0.0:*:*:*:*:*:*:*

cpe:2.3:a:ibm:connections:4.5.0.0:*:*:*:*:*:*:*

cpe:2.3:a:ibm:connections:5.0.0.0:*:*:*:*:*:*:*

EPSS

Процентиль: 13%

0.00044

Низкий

3.5 Low

CVSS3

3.5 Low

CVSS2

Дефекты

CWE-352

Связанные уязвимости

GHSA-9vmx-xr4x-44wg

CVSS3: 3.5

github

больше 3 лет назад

EPSS

Процентиль: 13%

0.00044

Низкий

3.5 Low

CVSS3

3.5 Low

CVSS2

Дефекты

CWE-352