CVE-2016-3031: XSS

Published Apr 5, 2017

Updated

IBM Cognos Analytics 11.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM Reference #: 1998887.

Affected Software

5 affected components

IBM Cognos Analytics=11.0.0

IBM Cognos Analytics=11.0.1

IBM Cognos Analytics=11.0.2

IBM Cognos Analytics=11.0.3

IBM Cognos Analytics=11.0.4

Remediation

Patch Available

http://www.ibm.com/support/docview.wss?uid=swg21998887

Event History

Apr 5, 2017

CVE Published

via MITRE·06:00 PM

Data Sourced

via MITRE·06:00 PM

DescriptionWeakness

Frequently Asked Questions

What is the severity of CVE-2016-3031?

CVE-2016-3031 has a moderate severity level due to its potential for cross-site scripting attacks.

How do I fix CVE-2016-3031?

To fix CVE-2016-3031, upgrade to a patched version of IBM Cognos Analytics that addresses this vulnerability.

What versions of IBM Cognos Analytics are affected by CVE-2016-3031?

CVE-2016-3031 affects IBM Cognos Analytics versions 11.0.0, 11.0.1, 11.0.2, 11.0.3, and 11.0.4.

What are the potential impacts of CVE-2016-3031?

The potential impacts of CVE-2016-3031 include the ability for attackers to execute arbitrary JavaScript, leading to possible credential disclosure.

Is there a workaround for CVE-2016-3031?

There are no documented workarounds for CVE-2016-3031; the best course of action is to apply the available security updates.