CVE-2016-9986: XSS
IBM Jazz Foundation Reporting Service (JRS) 5.0 and 6.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 120552.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2016-9986?
CVE-2016-9986 is classified as a moderate severity vulnerability due to its potential for cross-site scripting and credentials disclosure.
How do I fix CVE-2016-9986?
To fix CVE-2016-9986, upgrade IBM Jazz Reporting Service to a version that is not vulnerable, specifically versions 5.0.3, 6.0.4 or higher.
Who is affected by CVE-2016-9986?
CVE-2016-9986 affects users of IBM Jazz Reporting Service versions 5.0, 5.0.1, 5.0.2, 6.0, 6.0.1, 6.0.2, and 6.0.3.
What type of attacks can be executed due to CVE-2016-9986?
Due to CVE-2016-9986, attackers can execute cross-site scripting attacks which may lead to unauthorized access to user credentials.
Is user interaction required for CVE-2016-9986 exploitation?
Yes, exploiting CVE-2016-9986 typically requires user interaction to trigger the malicious JavaScript in the web UI.