CVE-2016-5899: XSS

Published Feb 1, 2017

Updated

IBM Jazz Reporting Service (JRS) is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.

Affected Software

6 affected components

IBM Jazz Reporting Service=5.0

IBM Jazz Reporting Service=5.0.1

IBM Jazz Reporting Service=5.0.2

IBM Jazz Reporting Service=6.0

IBM Jazz Reporting Service=6.0.1

IBM Jazz Reporting Service=6.0.2

Remediation

Patch Available

http://www.ibm.com/support/docview.wss?uid=swg21991154

Event History

Feb 1, 2017

CVE Published

via MITRE·08:00 PM

Data Sourced

via MITRE·08:00 PM

DescriptionWeakness

Data Sourced

via NVD·08:59 PM

RemedyDescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the severity of CVE-2016-5899?

CVE-2016-5899 has a medium severity rating due to its potential for credential disclosure and impact on trusted sessions.

How do I fix CVE-2016-5899?

To fix CVE-2016-5899, users should update to the patched versions of IBM Jazz Reporting Service 5.0.2, 6.0.1, or 6.0.2.

What types of attacks can CVE-2016-5899 enable?

CVE-2016-5899 can enable cross-site scripting (XSS) attacks, allowing malicious scripts to be injected into the web interface.

Which versions of IBM Jazz Reporting Service are affected by CVE-2016-5899?

CVE-2016-5899 affects IBM Jazz Reporting Service versions 5.0, 5.0.1, 6.0, 6.0.1, and 6.0.2.

Is user interaction required to exploit CVE-2016-5899?

Yes, user interaction is required to exploit CVE-2016-5899 as it involves executing JavaScript code through the web UI.