CVE-2016-5883: XSS

Published Feb 23, 2017

Updated

IBM iNotes 8.5 and 9.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM Reference #: 1997010.

Affected Software

25 affected components

IBM iNotes=8.5.1.0

IBM iNotes=8.5.1.1

IBM iNotes=8.5.1.2

IBM iNotes=8.5.1.3

IBM iNotes=8.5.1.4

IBM iNotes=8.5.1.5

IBM iNotes=8.5.2.0

IBM iNotes=8.5.2.1

IBM iNotes=8.5.2.2

IBM iNotes=8.5.2.3

IBM iNotes=8.5.3.0

IBM iNotes=8.5.3.1

IBM iNotes=8.5.3.2

IBM iNotes=8.5.3.3

IBM iNotes=8.5.3.4

IBM iNotes=8.5.3.5

IBM iNotes=8.5.3.6

IBM iNotes=9.0.0.0

IBM iNotes=9.0.1.0

IBM iNotes=9.0.1.1

IBM iNotes=9.0.1.2

IBM iNotes=9.0.1.3

IBM iNotes=9.0.1.4

IBM iNotes=9.0.1.5

IBM iNotes=9.0.1.6

Remediation

Patch Available

http://www.ibm.com/support/docview.wss?uid=swg21997010

Event History

Feb 23, 2017

CVE Published

via MITRE·04:00 PM

Data Sourced

via MITRE·04:00 PM

DescriptionWeakness

Data Sourced

via NVD·04:59 PM

RemedyDescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the severity of CVE-2016-5883?

CVE-2016-5883 is classified as a moderate severity vulnerability due to the risk of cross-site scripting attacks.

How do I fix CVE-2016-5883?

To fix CVE-2016-5883, update IBM iNotes to the latest version where the vulnerability has been patched.

What systems are affected by CVE-2016-5883?

CVE-2016-5883 affects various versions of IBM iNotes, including versions 8.5.1.0 to 8.5.3.6 and 9.0.0.0 to 9.0.1.6.

What type of attack does CVE-2016-5883 enable?

CVE-2016-5883 enables cross-site scripting (XSS) attacks which can lead to unauthorized script execution within a user's session.

Can I be targeted by CVE-2016-5883 if I use an updated version of IBM iNotes?

If you are using an updated version of IBM iNotes that addresses CVE-2016-5883, you should be protected from this vulnerability.