CVE-2016-0313: XSS

Published Jul 8, 2016

Updated

Cross-site scripting (XSS) vulnerability in the Report Builder and Data Collection Component (DCC) in IBM Jazz Reporting Service (JRS) 5.x before 5.0.2 ifix016 and 6.x before 6.0.1 ifix005 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL, a different vulnerability than CVE-2016-2888 and CVE-2016-0350.

Affected Software

5 affected components

IBM Jazz Reporting Service=5.0

IBM Jazz Reporting Service=5.0.1

IBM Jazz Reporting Service=5.0.2

IBM Jazz Reporting Service=6.0

IBM Jazz Reporting Service=6.0.1

Event History

Jul 8, 2016

CVE Published

via MITRE·01:00 AM

Data Sourced

via MITRE·01:00 AM

Description

Frequently Asked Questions

What is the severity of CVE-2016-0313?

CVE-2016-0313 is classified as a medium severity vulnerability due to its potential to allow Cross-Site Scripting (XSS) attacks.

How do I fix CVE-2016-0313?

To fix CVE-2016-0313, upgrade IBM Jazz Reporting Service to version 5.0.2 ifix016 or 6.0.1 ifix005 or later.

Which versions of IBM Jazz Reporting Service are affected by CVE-2016-0313?

CVE-2016-0313 affects IBM Jazz Reporting Service versions 5.0, 5.0.1, and 6.0 up to 6.0.1 ifix005.

What type of attack can CVE-2016-0313 facilitate?

CVE-2016-0313 can facilitate Cross-Site Scripting (XSS) attacks by allowing the injection of arbitrary web scripts.

Who can exploit CVE-2016-0313?

CVE-2016-0313 can be exploited by remote authenticated users who have access to inject crafted URLs.