CVE-2016-0315: High severity ibm jazz reporting service vulnerability

Published Jul 8, 2016

Updated

The Report Builder and Data Collection Component (DCC) in IBM Jazz Reporting Service (JRS) 5.x before 5.0.2 ifix016 and 6.x before 6.0.1 ifix005 maintain session ID validity after a logout action, which allows remote authenticated users to hijack sessions by leveraging an unattended workstation.

Affected Software

5 affected components

IBM Jazz Reporting Service=5.0

IBM Jazz Reporting Service=5.0.1

IBM Jazz Reporting Service=5.0.2

IBM Jazz Reporting Service=6.0

IBM Jazz Reporting Service=6.0.1

Event History

Jul 8, 2016

CVE Published

via MITRE·01:00 AM

Data Sourced

via MITRE·01:00 AM

Description

Frequently Asked Questions

What is the severity of CVE-2016-0315?

CVE-2016-0315 is classified as a medium severity vulnerability.

How do I fix CVE-2016-0315?

To fix CVE-2016-0315, upgrade to IBM Jazz Reporting Service version 5.0.2 ifix016 or 6.0.1 ifix005 or later.

What is the impact of CVE-2016-0315?

CVE-2016-0315 allows remote authenticated users to hijack sessions by maintaining session ID validity after logout.

Which versions of IBM Jazz Reporting Service are affected by CVE-2016-0315?

CVE-2016-0315 affects IBM Jazz Reporting Service versions 5.0, 5.0.1, 5.0.2, 6.0, and 6.0.1 before specified ifixes.

Can CVE-2016-0315 be exploited from an unattended workstation?

Yes, CVE-2016-0315 can be exploited from an unattended workstation by leveraging the session ID.