CVE-2016-1599: XSS
Published Mar 24, 2016
·Updated
Cross-site scripting (XSS) vulnerability in NetIQ Self Service Password Reset (SSPR) 2.x and 3.x before 3.3.1 HF2 allows remote attackers to inject arbitrary web script or HTML via a crafted URL.
Affected Software
6 affected components
Microfocus Self Service Password Reset=2.0
Microfocus Self Service Password Reset=3.0
Microfocus Self Service Password Reset=3.1
Microfocus Self Service Password Reset=3.2
Microfocus Self Service Password Reset=3.3
Microfocus Self Service Password Reset=3.3.1
Event History
Mar 24, 2016
CVE Published
via MITRE·01:00 AM
Data Sourced
via MITRE·01:00 AM
Description
Frequently Asked Questions
1
What is the severity of CVE-2016-1599?
CVE-2016-1599 is categorized as a medium severity cross-site scripting (XSS) vulnerability.
2
How do I fix CVE-2016-1599?
To fix CVE-2016-1599, upgrade to NetIQ Self Service Password Reset version 3.3.1 HF2 or later.
3
What versions of NetIQ Self Service Password Reset are affected by CVE-2016-1599?
CVE-2016-1599 affects NetIQ Self Service Password Reset versions 2.x and 3.x up to 3.3.1 HF1.
4
Can CVE-2016-1599 be exploited remotely?
Yes, CVE-2016-1599 can be exploited remotely through crafted URLs that inject arbitrary web scripts.
5
What impact does CVE-2016-1599 have on users?
CVE-2016-1599 allows attackers to execute malicious scripts in the context of the user's browser session, potentially leading to data theft or account compromise.