CVE-2016-5944: XSS

Published Sep 26, 2016

Updated

Cross-site scripting (XSS) vulnerability in the Web UI in IBM Spectrum Control (formerly Tivoli Storage Productivity Center) 5.2.x before 5.2.11 allows remote authenticated users to inject arbitrary web script or HTML via an embedded string.

Affected Software

16 affected components

IBM Spectrum Control=5.2.8

IBM Spectrum Control=5.2.9

IBM Spectrum Control=5.2.10

IBM Spectrum Control=5.2.10.1

IBM Tivoli Storage Productivity Center=5.2.0

IBM Tivoli Storage Productivity Center=5.2.1

IBM Tivoli Storage Productivity Center=5.2.1.1

IBM Tivoli Storage Productivity Center=5.2.2

IBM Tivoli Storage Productivity Center=5.2.3

IBM Tivoli Storage Productivity Center=5.2.4

IBM Tivoli Storage Productivity Center=5.2.4.1

IBM Tivoli Storage Productivity Center=5.2.5

IBM Tivoli Storage Productivity Center=5.2.5.1

IBM Tivoli Storage Productivity Center=5.2.6

IBM Tivoli Storage Productivity Center=5.2.7

IBM Tivoli Storage Productivity Center=5.2.7.1

Remediation

Patch Available

http://www-01.ibm.com/support/docview.wss?uid=swg21988625

Event History

Sep 26, 2016

CVE Published

via MITRE·01:00 AM

Data Sourced

via MITRE·01:00 AM

Description

Frequently Asked Questions

What is the severity of CVE-2016-5944?

CVE-2016-5944 has a medium severity level due to its cross-site scripting (XSS) capabilities that can compromise user data.

How do I fix CVE-2016-5944?

To fix CVE-2016-5944, upgrade to IBM Spectrum Control version 5.2.11 or later.

Who is affected by CVE-2016-5944?

CVE-2016-5944 affects users of IBM Spectrum Control versions 5.2.0 to 5.2.10 and associated Tivoli Storage Productivity Center versions.

Can CVE-2016-5944 be exploited remotely?

Yes, CVE-2016-5944 can be exploited remotely by authenticated users to inject arbitrary web scripts.

What type of vulnerability is CVE-2016-5944 classified as?

CVE-2016-5944 is classified as a cross-site scripting (XSS) vulnerability.