CVE-2016-2998: CSRF
First published: Thu Sep 01 2016(Updated: )
Cross-site request forgery (CSRF) vulnerability in IBM Connections 4.0 through CR4, 4.5 through CR5, 5.0 before CR4, and 5.5 before CR1 allows remote authenticated users to hijack the authentication of arbitrary users for requests that update data.
Credit: psirt@us.ibm.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| IBM Connections Portlets | =4.0.0.0 | |
| IBM Connections Portlets | =4.5.0.0 | |
| IBM Connections Portlets | =5.0.0.0 | |
| IBM Connections Portlets | =5.5.0.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2016-2998?
CVE-2016-2998 has a medium severity level due to the potential for data hijacking by authenticated users.
How do I fix CVE-2016-2998?
To fix CVE-2016-2998, you should apply the latest patches or updates provided by IBM for affected HCL Connections versions.
What software versions are affected by CVE-2016-2998?
CVE-2016-2998 affects IBM Connections versions 4.0 through CR4, 4.5 through CR5, 5.0 before CR4, and 5.5 before CR1.
What type of vulnerability is CVE-2016-2998?
CVE-2016-2998 is categorized as a Cross-Site Request Forgery (CSRF) vulnerability.
What can an attacker do with CVE-2016-2998?
An attacker exploiting CVE-2016-2998 can hijack authentication to perform unauthorized actions on behalf of other authenticated users.
- agent/type
- collector/mitre-cve
- source/MITRE
- agent/severity
- agent/last-modified-date
- agent/references
- agent/remedy
- agent/author
- agent/first-publish-date
- agent/event
- agent/description
- agent/softwarecombine
- agent/weakness
- agent/source
- agent/tags
- collector/nvd-index
- agent/software-canonical-lookup-request
- vendor/ibm
- canonical/ibm connections portlets
- version/ibm connections portlets/4.0.0.0
- version/ibm connections portlets/4.5.0.0
- version/ibm connections portlets/5.0.0.0
- version/ibm connections portlets/5.5.0.0