CVE-2016-9000: XSS

Published Feb 1, 2017

Updated

IBM InfoSphere DataStage is vulnerable to cross-frame scripting, caused by insufficient HTML iframe protection. A remote attacker could exploit this vulnerability using a specially-crafted URL to navigate to a web page the attacker controls. An attacker could use this vulnerability to conduct clickjacking or other client-side browser attacks.

Affected Software

5 affected components

IBM InfoSphere DataStage=8.7

IBM InfoSphere DataStage=9.1

IBM InfoSphere DataStage=11.3

IBM InfoSphere DataStage=11.5

IBM Infosphere Information Server On Cloud=11.5

Remediation

Patch Available

http://www.ibm.com/support/docview.wss?uid=swg21995257

Event History

Feb 1, 2017

CVE Published

via MITRE·10:00 PM

Data Sourced

via MITRE·10:00 PM

DescriptionWeakness

Data Sourced

via NVD·10:59 PM

RemedyDescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the severity of CVE-2016-9000?

CVE-2016-9000 has a medium severity rating due to its potential to enable cross-frame scripting attacks.

How do I fix CVE-2016-9000?

To fix CVE-2016-9000, apply the recommended updates and patches provided by IBM for affected versions of InfoSphere DataStage.

What versions of IBM InfoSphere DataStage are affected by CVE-2016-9000?

CVE-2016-9000 affects IBM InfoSphere DataStage versions 8.7, 9.1, 11.3, and 11.5.

Can CVE-2016-9000 be exploited remotely?

Yes, CVE-2016-9000 can be exploited remotely by an attacker using a specially-crafted URL.

What is cross-frame scripting in the context of CVE-2016-9000?

Cross-frame scripting in CVE-2016-9000 refers to the vulnerability that allows an attacker to manipulate content within an iframe to conduct unauthorized actions.