CVE-2016-0399: XSS
Published Jul 2, 2016
·Updated
Cross-site scripting (XSS) vulnerability in IBM Maximo Asset Management 7.1 through 7.1.1.13, 7.5 before 7.5.0.9 IFIX007, and 7.6 before 7.6.0.5 FP005 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL.
Affected Software
28 affected components
IBM Maximo Asset Management=7.1
IBM Maximo Asset Management=7.1.1
IBM Maximo Asset Management=7.1.1.1
IBM Maximo Asset Management=7.1.1.2
IBM Maximo Asset Management=7.1.1.3
IBM Maximo Asset Management=7.1.1.5
IBM Maximo Asset Management=7.1.1.6
IBM Maximo Asset Management=7.1.1.7
IBM Maximo Asset Management=7.1.1.8
IBM Maximo Asset Management=7.1.1.9
IBM Maximo Asset Management=7.1.1.10
IBM Maximo Asset Management=7.1.1.11
IBM Maximo Asset Management=7.1.1.12
IBM Maximo Asset Management=7.1.1.13
IBM Maximo Asset Management=7.1.2
IBM Maximo Asset Management=7.5.0.0
IBM Maximo Asset Management=7.5.0.1
IBM Maximo Asset Management=7.5.0.2
IBM Maximo Asset Management=7.5.0.3
IBM Maximo Asset Management=7.5.0.4
IBM Maximo Asset Management=7.5.0.5
IBM Maximo Asset Management=7.5.0.6
IBM Maximo Asset Management=7.5.0.7
IBM Maximo Asset Management=7.5.0.8
IBM Maximo Asset Management=7.5.0.9
IBM Maximo Asset Management=7.5.0.10
IBM Maximo Asset Management=7.6.0.4
IBM Maximo Asset Management=7.6.0.5
Event History
Jul 2, 2016
CVE Published
via MITRE·02:00 PM
Data Sourced
via MITRE·02:00 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2016-0399?
CVE-2016-0399 has a medium severity level due to its potential for cross-site scripting (XSS) attacks.
2
How do I fix CVE-2016-0399?
To fix CVE-2016-0399, ensure that you upgrade IBM Maximo Asset Management to versions 7.5.0.9 or higher, or 7.6.0.5 or higher.
3
What versions of IBM Maximo Asset Management are affected by CVE-2016-0399?
CVE-2016-0399 affects versions 7.1 through 7.1.1.13, 7.5 before 7.5.0.9 IFIX007, and 7.6 before 7.6.0.5 FP005.
4
Can CVE-2016-0399 be exploited remotely?
Yes, CVE-2016-0399 can be exploited remotely by authenticated users through a crafted URL.
5
What type of vulnerability is CVE-2016-0399?
CVE-2016-0399 is classified as a cross-site scripting (XSS) vulnerability.