CVE-2016-2912: XSS

Published Aug 8, 2016

Updated

Cross-site scripting (XSS) vulnerability in the Document Builder in IBM Rational Publishing Engine (aka RPENG) 2.0.1 before ifix002 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL.

Affected Software

2 affected components

IBM Rational Publishing Engine=2.0.1

IBM Engineering Lifecycle Optimization - Publishing=2.0.1

Event History

Aug 8, 2016

CVE Published

via MITRE·01:00 AM

Data Sourced

via MITRE·01:00 AM

Description

Data Sourced

via NVD·01:59 AM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the severity of CVE-2016-2912?

CVE-2016-2912 is classified as a medium severity vulnerability due to its potential for cross-site scripting attacks.

How do I fix CVE-2016-2912?

To mitigate CVE-2016-2912, upgrade IBM Rational Publishing Engine to version 2.0.1 with ifix002 or later.

Who is affected by CVE-2016-2912?

CVE-2016-2912 affects remote authenticated users of IBM Rational Publishing Engine version 2.0.1 before ifix002.

What types of attacks can CVE-2016-2912 facilitate?

CVE-2016-2912 can facilitate cross-site scripting (XSS) attacks that allow attackers to inject arbitrary web scripts or HTML.

Is CVE-2016-2912 easy to exploit?

CVE-2016-2912 can be exploited easily by sending crafted URLs to authenticated users.