CVE-2016-9723: XSS

Published Mar 7, 2017

Updated

IBM QRadar 7.2 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM Reference #: 1999534.

Affected Software

18 affected components

IBM QRadar Incident Forensics=7.2.0

IBM QRadar Incident Forensics=7.2.1

IBM QRadar Incident Forensics=7.2.2

IBM QRadar Incident Forensics=7.2.3

IBM QRadar Incident Forensics=7.2.4

IBM QRadar Incident Forensics=7.2.5

IBM QRadar Incident Forensics=7.2.6

IBM QRadar Incident Forensics=7.2.7

IBM QRadar Incident Forensics=7.2.8

IBM QRadar Security Information and Event Manager=7.2.0

IBM QRadar Security Information and Event Manager=7.2.1

IBM QRadar Security Information and Event Manager=7.2.2

IBM QRadar Security Information and Event Manager=7.2.3

IBM QRadar Security Information and Event Manager=7.2.4

IBM QRadar Security Information and Event Manager=7.2.5

IBM QRadar Security Information and Event Manager=7.2.6

IBM QRadar Security Information and Event Manager=7.2.7

IBM QRadar Security Information and Event Manager=7.2.8

Remediation

Patch Available

http://www.ibm.com/support/docview.wss?uid=swg21999534

Event History

Mar 7, 2017

CVE Published

via MITRE·05:00 PM

Data Sourced

via MITRE·05:00 PM

DescriptionWeakness

Frequently Asked Questions

What is the severity of CVE-2016-9723?

CVE-2016-9723 has a medium severity rating due to its potential to allow cross-site scripting attacks.

How do I fix CVE-2016-9723?

To fix CVE-2016-9723, update IBM QRadar Incident Forensics or Security Information and Event Manager to a version that patches the cross-site scripting vulnerability.

What versions are affected by CVE-2016-9723?

CVE-2016-9723 affects IBM QRadar versions 7.2.0 through 7.2.8.

What is the impact of CVE-2016-9723?

The impact of CVE-2016-9723 is the potential disclosure of user credentials through the execution of malicious JavaScript in the Web UI.

Who is responsible for addressing CVE-2016-9723?

IBM is responsible for addressing CVE-2016-9723, and users should follow their guidance for updates related to this vulnerability.