CVE-2016-5978: XSS
First published: Mon Sep 26 2016(Updated: )
Cross-site scripting (XSS) vulnerability in the Web UI in the web portal in IBM Tealeaf Customer Experience before 8.7.1.8847 FP10, 8.8 before 8.8.0.9049 FP9, 9.0.0 and 9.0.1 before 9.0.1.1117 FP5, 9.0.1A before 9.0.1.5108_9.0.1A FP5, 9.0.2 before 9.0.2.1223 FP3, and 9.0.2A before 9.0.2.5224_9.0.2A FP3 allows remote authenticated users to inject arbitrary web script or HTML via an embedded string, a different vulnerability than CVE-2016-5975.
Credit: psirt@us.ibm.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| IBM Tealeaf CX | =8.7 | |
| IBM Tealeaf CX | =8.8 | |
| IBM Tealeaf CX | =9.0.0 | |
| IBM Tealeaf CX | =9.0.0a | |
| IBM Tealeaf CX | =9.0.1 | |
| IBM Tealeaf CX | =9.0.1a | |
| IBM Tealeaf CX | =9.0.2 | |
| IBM Tealeaf CX | =9.0.2a |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2016-5978?
CVE-2016-5978 has a medium severity rating due to its cross-site scripting (XSS) nature, which can potentially allow attackers to execute malicious scripts in users' browsers.
How do I fix CVE-2016-5978?
To address CVE-2016-5978, upgrade IBM Tealeaf Customer Experience to the latest version that is 8.7.1.8847 FP10 or above, or 8.8.0.9049 FP9 or above, or any versions mentioned above.
What versions of IBM Tealeaf Customer Experience are affected by CVE-2016-5978?
CVE-2016-5978 affects IBM Tealeaf Customer Experience versions prior to 8.7.1.8847 FP10, 8.8 before 8.8.0.9049 FP9, and versions 9.0.0 and 9.0.1 before 9.0.1.1117 FP5.
Are there any workarounds for CVE-2016-5978?
While upgrading is the best solution for CVE-2016-5978, implementing input validation on web forms may help mitigate some risks temporarily.
What type of vulnerability is CVE-2016-5978?
CVE-2016-5978 is a cross-site scripting (XSS) vulnerability that can allow attackers to inject and execute scripts in the context of a user’s session.
- agent/references
- agent/type
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/weakness
- agent/last-modified-date
- agent/author
- agent/severity
- agent/first-publish-date
- agent/event
- agent/description
- agent/source
- agent/tags
- collector/nvd-index
- agent/software-canonical-lookup-request
- vendor/ibm
- canonical/ibm tealeaf cx
- version/ibm tealeaf cx/8.7
- version/ibm tealeaf cx/8.8
- version/ibm tealeaf cx/9.0.0
- version/ibm tealeaf cx/9.0.0a
- version/ibm tealeaf cx/9.0.1
- version/ibm tealeaf cx/9.0.1a
- version/ibm tealeaf cx/9.0.2
- version/ibm tealeaf cx/9.0.2a