PT-2016-4141 · Ibm · Ibm Jazz Reporting Service

Publicado 2016-11-25 · Atualizado 2016-11-28 · CVE-2016-0316

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Média

Vetor base

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions IBM Jazz Reporting Service versions 6.0 through 6.0.1 before 6.0.1 iFix006 IBM Jazz Reporting Service version 6.0.2 before iFix003

Description A cross-site scripting (XSS) issue in the Lifecycle Query Engine (LQE) of IBM Jazz Reporting Service allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL. This could potentially lead to unauthorized actions on the affected system.

Recommendations For IBM Jazz Reporting Service versions 6.0 through 6.0.1, apply iFix006 to resolve the issue. For IBM Jazz Reporting Service version 6.0.2, apply iFix003 to resolve the issue.

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2016-0316

Produtos afetados

Ibm Jazz Reporting Service

Referências · 4

• http://www-01.ibm.com/support/docview.wss?uid=swg21983137 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2016-0316 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2016-0316 · Aviso do Fabricante
• http://securityfocus.com/bid/92472 · Nota