CVE-2016-6054: XSS

Published Feb 1, 2017

Updated

IBM Jazz Foundation is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.

Affected Software

6 affected components

IBM Jazz Reporting Service=5.0

IBM Jazz Reporting Service=5.0.1

IBM Jazz Reporting Service=5.0.2

IBM Jazz Reporting Service=6.0

IBM Jazz Reporting Service=6.0.1

IBM Jazz Reporting Service=6.0.2

Remediation

Patch Available

http://www.ibm.com/support/docview.wss?uid=swg21991154

Event History

Feb 1, 2017

CVE Published

via MITRE·08:00 PM

Data Sourced

via MITRE·08:00 PM

DescriptionWeakness

Data Sourced

via NVD·08:59 PM

RemedyDescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the severity of CVE-2016-6054?

CVE-2016-6054 has a medium severity rating due to potential impacts on user session security.

How do I fix CVE-2016-6054?

To fix CVE-2016-6054, upgrade to IBM Jazz Reporting Service version 6.0.2 or later.

What types of systems are affected by CVE-2016-6054?

CVE-2016-6054 affects IBM Jazz Reporting Service versions 5.0, 5.0.1, 5.0.2, and 6.0/6.0.1.

Can CVE-2016-6054 lead to credential disclosure?

Yes, CVE-2016-6054 can allow an attacker to embed JavaScript that may disclose user credentials during a trusted session.

What is the nature of the vulnerability in CVE-2016-6054?

CVE-2016-6054 is a cross-site scripting vulnerability that allows arbitrary JavaScript to be injected into the Web UI.