CVE-2016-3015: XSS

Published Apr 5, 2017

Updated

IBM Cognos Analytics 11.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM Reference #: 1998887.

Affected Software

5 affected components

IBM Cognos Analytics=11.0.0

IBM Cognos Analytics=11.0.1

IBM Cognos Analytics=11.0.2

IBM Cognos Analytics=11.0.3

IBM Cognos Analytics=11.0.4

Remediation

Patch Available

http://www.ibm.com/support/docview.wss?uid=swg21998887

Event History

Apr 5, 2017

CVE Published

via MITRE·06:00 PM

Data Sourced

via MITRE·06:00 PM

DescriptionWeakness

Frequently Asked Questions

What is the severity of CVE-2016-3015?

CVE-2016-3015 has a medium severity rating due to its potential for cross-site scripting attacks.

How do I fix CVE-2016-3015?

To fix CVE-2016-3015, update IBM Cognos Analytics to a version that addresses this vulnerability, such as versions higher than 11.0.4.

What software is affected by CVE-2016-3015?

CVE-2016-3015 affects IBM Cognos Analytics versions 11.0.0 to 11.0.4.

What type of vulnerability is CVE-2016-3015?

CVE-2016-3015 is a cross-site scripting (XSS) vulnerability.

What are the potential risks of CVE-2016-3015?

The risks of CVE-2016-3015 include the possibility of credential disclosure and unauthorized actions within a trusted session.