CVE-2016-8960

Опубликовано: 27 мар. 2017

Источник: nvd

CVSS3: 8.8

CVSS2: 6.5

EPSS Низкий

Описание

IBM Cognos Business Intelligence 10.2 could allow a user with lower privilege Capabilities to adopt the Capabilities of a higher-privilege user by intercepting the higher-privilege user's cookie value from its HTTP request and then reusing it in subsequent requests. IBM Reference #: 1993718.

Ссылки

http://www.ibm.com/support/docview.wss?uid=swg21993718
Patch
Vendor Advisory
http://www.securityfocus.com/bid/96963
Third Party Advisory
VDB Entry
http://www.ibm.com/support/docview.wss?uid=swg21993718
Patch
Vendor Advisory
http://www.securityfocus.com/bid/96963
Third Party Advisory
VDB Entry

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:ibm:cognos_business_intelligence:10.2:*:*:*:*:*:*:*

cpe:2.3:a:ibm:cognos_business_intelligence:10.2.1:*:*:*:*:*:*:*

cpe:2.3:a:ibm:cognos_business_intelligence:10.2.1.1:*:*:*:*:*:*:*

cpe:2.3:a:ibm:cognos_business_intelligence:10.2.2:*:*:*:*:*:*:*

EPSS

Процентиль: 66%

0.00526

Низкий

8.8 High

CVSS3

6.5 Medium

CVSS2

Дефекты

CWE-264

Связанные уязвимости

GHSA-vxjm-8m57-p725