CVE-2016-8943: XSS

Published Feb 1, 2017

Updated

IBM Tivoli Storage Productivity Center is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.

Affected Software

18 affected components

IBM Spectrum Control=5.2.8

IBM Spectrum Control=5.2.9

IBM Spectrum Control=5.2.10

IBM Spectrum Control=5.2.11

IBM Tivoli Storage Productivity Center=5.2.0

IBM Tivoli Storage Productivity Center=5.2.0.0

IBM Tivoli Storage Productivity Center=5.2.1.0

IBM Tivoli Storage Productivity Center=5.2.1.1

IBM Tivoli Storage Productivity Center=5.2.2.0

IBM Tivoli Storage Productivity Center=5.2.3.0

IBM Tivoli Storage Productivity Center=5.2.4.0

IBM Tivoli Storage Productivity Center=5.2.4.1

IBM Tivoli Storage Productivity Center=5.2.4.1_\+

IBM Tivoli Storage Productivity Center=5.2.5.0

IBM Tivoli Storage Productivity Center=5.2.5.1

IBM Tivoli Storage Productivity Center=5.2.6.0

IBM Tivoli Storage Productivity Center=5.2.7.0

IBM Tivoli Storage Productivity Center=5.2.7.1

Remediation

Patch Available

http://www.ibm.com/support/docview.wss?uid=swg21995128

Event History

Feb 1, 2017

CVE Published

via MITRE·08:00 PM

Data Sourced

via MITRE·08:00 PM

DescriptionWeakness

Data Sourced

via NVD·08:59 PM

RemedyDescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the severity of CVE-2016-8943?

CVE-2016-8943 is considered a medium severity vulnerability due to its potential for cross-site scripting that may lead to credential disclosure.

How do I fix CVE-2016-8943?

To fix CVE-2016-8943, ensure that you update IBM Tivoli Storage Productivity Center and IBM Spectrum Control to the latest patched versions.

Which versions are affected by CVE-2016-8943?

CVE-2016-8943 affects multiple versions including 5.2.0 to 5.2.11 of IBM Tivoli Storage Productivity Center and IBM Spectrum Control.

Can CVE-2016-8943 lead to data breaches?

Yes, CVE-2016-8943 can potentially lead to data breaches due to the possibility of credential disclosure within a trusted session.

Is CVE-2016-8943 common in web applications?

CVE-2016-8943 exemplifies a common type of security risk found in web applications, specifically cross-site scripting vulnerabilities.