CVE-2016-2863: XSS
First published: Sun Jul 03 2016(Updated: )
Cross-site request forgery (CSRF) vulnerability in IBM WebSphere Commerce 7.0 Feature Pack 8, 8.0.0.x before 8.0.0.10, and 8.0.1.x before 8.0.1.2 allows remote authenticated users to hijack the authentication of arbitrary users for requests that insert XSS sequences.
Credit: psirt@us.ibm.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| IBM WebSphere Commerce | =7.0-feature_pack_8 | |
| IBM WebSphere Commerce | =8.0.0.0 | |
| IBM WebSphere Commerce | =8.0.0.1 | |
| IBM WebSphere Commerce | =8.0.0.2 | |
| IBM WebSphere Commerce | =8.0.0.3 | |
| IBM WebSphere Commerce | =8.0.0.5 | |
| IBM WebSphere Commerce | =8.0.0.6 | |
| IBM WebSphere Commerce | =8.0.0.7 | |
| IBM WebSphere Commerce | =8.0.0.8 | |
| IBM WebSphere Commerce | =8.0.0.9 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2016-2863?
CVE-2016-2863 is considered a moderate severity vulnerability due to its ability to allow authenticated users to perform unauthorized actions.
How do I fix CVE-2016-2863?
To fix CVE-2016-2863, update IBM WebSphere Commerce to version 8.0.0.10 or 8.0.1.2 or later.
Who is affected by CVE-2016-2863?
CVE-2016-2863 affects users of IBM WebSphere Commerce versions 7.0 Feature Pack 8 and 8.0.0.x before 8.0.0.10 and 8.0.1.x before 8.0.1.2.
What type of vulnerability is CVE-2016-2863?
CVE-2016-2863 is a cross-site request forgery (CSRF) vulnerability allowing impersonation of other users.
What can attackers do with CVE-2016-2863?
Attackers exploiting CVE-2016-2863 can hijack authenticated sessions of other users, potentially leading to unauthorized actions.
- agent/weakness
- agent/references
- agent/type
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/author
- agent/severity
- agent/description
- agent/softwarecombine
- agent/first-publish-date
- agent/event
- agent/source
- agent/tags
- collector/nvd-index
- agent/software-canonical-lookup-request
- vendor/ibm
- canonical/ibm websphere commerce
- version/ibm websphere commerce/7.0-feature_pack_8
- version/ibm websphere commerce/8.0.0.0
- version/ibm websphere commerce/8.0.0.1
- version/ibm websphere commerce/8.0.0.2
- version/ibm websphere commerce/8.0.0.3
- version/ibm websphere commerce/8.0.0.5
- version/ibm websphere commerce/8.0.0.6
- version/ibm websphere commerce/8.0.0.7
- version/ibm websphere commerce/8.0.0.8
- version/ibm websphere commerce/8.0.0.9