PT-2016-4141 · Ibm · Ibm Jazz Reporting Service

Published 2016-11-25 · Updated 2016-11-28 · CVE-2016-0316

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions IBM Jazz Reporting Service versions 6.0 through 6.0.1 before 6.0.1 iFix006 IBM Jazz Reporting Service version 6.0.2 before iFix003

Description A cross-site scripting (XSS) issue in the Lifecycle Query Engine (LQE) of IBM Jazz Reporting Service allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL. This could potentially lead to unauthorized actions on the affected system.

Recommendations For IBM Jazz Reporting Service versions 6.0 through 6.0.1, apply iFix006 to resolve the issue. For IBM Jazz Reporting Service version 6.0.2, apply iFix003 to resolve the issue.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2016-0316

Affected Products

Ibm Jazz Reporting Service

References · 4

• http://www-01.ibm.com/support/docview.wss?uid=swg21983137 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2016-0316 · Security Note
• https://osv.dev/vulnerability/CVE-2016-0316 · Vendor Advisory
• http://securityfocus.com/bid/92472 · Note