CVE-2016-9697: Infoleak

Published Mar 20, 2017

Updated

An unspecified vulnerability in IBM Rhapsody DM 4.0, 5.0, and 6.0 could allow an attacker to perform a JSON Hijacking Attack. A JSON Hijacking Attack may expose to an attacker information passed between the server and the browser. IBM Reference #: 1999960.

Affected Software

14 affected components

IBM Rational Rhapsody Design Manager=4.0

IBM Rational Rhapsody Design Manager=4.0.1

IBM Rational Rhapsody Design Manager=4.0.2

IBM Rational Rhapsody Design Manager=4.0.3

IBM Rational Rhapsody Design Manager=4.0.4

IBM Rational Rhapsody Design Manager=4.0.5

IBM Rational Rhapsody Design Manager=4.0.6

IBM Rational Rhapsody Design Manager=4.0.7

IBM Rational Rhapsody Design Manager=5.0

IBM Rational Rhapsody Design Manager=5.0.1

IBM Rational Rhapsody Design Manager=5.0.2

IBM Rational Rhapsody Design Manager=6.0

IBM Rational Rhapsody Design Manager=6.0.1

IBM Rational Rhapsody Design Manager=6.0.2

Remediation

Patch Available

http://www.ibm.com/support/docview.wss?uid=swg21999960

Event History

Mar 20, 2017

CVE Published

via MITRE·04:00 PM

Data Sourced

via MITRE·04:00 PM

DescriptionWeakness

Frequently Asked Questions

What is the severity of CVE-2016-9697?

The severity of CVE-2016-9697 is considered moderate due to the potential for information exposure.

How do I fix CVE-2016-9697?

To fix CVE-2016-9697, upgrade to the latest version of IBM Rhapsody Design Manager that has addressed the vulnerability.

What versions of IBM Rhapsody Design Manager are affected by CVE-2016-9697?

CVE-2016-9697 affects versions 4.0 through 6.0.2 of IBM Rhapsody Design Manager.

What type of attack is associated with CVE-2016-9697?

CVE-2016-9697 is associated with a JSON Hijacking Attack that may expose sensitive information.

Can CVE-2016-9697 affect client-side applications?

Yes, CVE-2016-9697 can affect client-side applications by exposing data exchanged between the server and the browser.