CVE-2016-9715: XSS

Published Jul 31, 2017

Updated

IBM InfoSphere Master Data Management Server 11.0, 11.3, 11.4, 11.5, and 11.6 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 119728.

Affected Software

5 affected components

IBM InfoSphere Master Data Management Server=11.0

IBM InfoSphere Master Data Management Server=11.3

IBM InfoSphere Master Data Management Server=11.4

IBM InfoSphere Master Data Management Server=11.5

IBM InfoSphere Master Data Management Server=11.6

Remediation

Patch Available

http://www.ibm.com/support/docview.wss?uid=swg22006611

Event History

Jul 31, 2017

CVE Published

via MITRE·09:00 PM

Data Sourced

via MITRE·09:00 PM

DescriptionWeakness

Frequently Asked Questions

What is the severity of CVE-2016-9715?

CVE-2016-9715 is classified as a cross-site scripting vulnerability which can lead to severe security risks including credential disclosure.

How do I fix CVE-2016-9715?

To fix CVE-2016-9715, it is recommended to update the IBM InfoSphere Master Data Management Server to the latest patched version provided by IBM.

What versions of IBM InfoSphere Master Data Management Server are affected by CVE-2016-9715?

CVE-2016-9715 affects IBM InfoSphere Master Data Management Server versions 11.0, 11.3, 11.4, 11.5, and 11.6.

What can attackers do with CVE-2016-9715?

Attackers exploiting CVE-2016-9715 can embed arbitrary JavaScript code in the Web UI, potentially altering functionality and stealing user credentials.

Is there a workaround for CVE-2016-9715?

There is no specific workaround for CVE-2016-9715; the best approach is to apply the latest security updates from IBM.