Lucene search

[email protected]CVE-2016-0217

HistoryFeb 01, 2017 - 10:59 p.m.

CVE-2016-0217

2017-02-0122:59:00

CWE-79

[email protected]

web.nvd.nist.gov

ibm cognos

business intelligence

analytics

stored xss

remote attacker

web pages

authentication credentials

3.5 Low

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

SINGLE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:S/C:N/I:P/A:N

5.4 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

6.2 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

25.8%

JSON

IBM Cognos Business Intelligence and IBM Cognos Analytics are vulnerable to stored cross-site scripting, caused by improper validation of user-supplied input. A remote attacker could exploit this vulnerability to inject malicious script into a Web page which would be executed in a victim’s Web browser within the security context of the hosting Web site, once the page is viewed. An attacker could use this vulnerability to steal the victim’s cookie-based authentication credentials.

Affected configurations

Vulners

NVD

Node

ibm_corporationcognos_business_intelligenceMatch10

ibm_corporationcognos_business_intelligenceMatch8.3.0

ibm_corporationcognos_business_intelligenceMatch8.4.1

ibm_corporationcognos_business_intelligenceMatch8.4

ibm_corporationcognos_business_intelligenceMatch10.1

ibm_corporationcognos_business_intelligenceMatch10.1.1

ibm_corporationcognos_business_intelligenceMatch10.2

ibm_corporationcognos_business_intelligenceMatch10.2.1

ibm_corporationcognos_business_intelligenceMatch10.2.1.1

ibm_corporationcognos_business_intelligenceMatch10.2.2

ibm_corporationcognos_business_intelligenceMatch2

CPENameOperatorVersion
ibm:cognos_analyticsibm cognos analyticseq11.0.0
ibm:cognos_analyticsibm cognos analyticseq11.0.1
ibm:cognos_analyticsibm cognos analyticseq11.0.2
ibm:cognos_analyticsibm cognos analyticseq11.0.3
ibm:cognos_analyticsibm cognos analyticseq11.0.4

CPE	Name	Operator	Version
ibm:cognos_analytics	ibm cognos analytics	eq	11.0.0
ibm:cognos_analytics	ibm cognos analytics	eq	11.0.1
ibm:cognos_analytics	ibm cognos analytics	eq	11.0.2
ibm:cognos_analytics	ibm cognos analytics	eq	11.0.3
ibm:cognos_analytics	ibm cognos analytics	eq	11.0.4

CNA Affected

[
  {
    "product": "Cognos Business Intelligence",
    "vendor": "IBM Corporation",
    "versions": [
      {
        "status": "affected",
        "version": "10"
      },
      {
        "status": "affected",
        "version": "8.3.0"
      },
      {
        "status": "affected",
        "version": "8.4.1"
      },
      {
        "status": "affected",
        "version": "8.4"
      },
      {
        "status": "affected",
        "version": "10.1"
      },
      {
        "status": "affected",
        "version": "10.1.1"
      },
      {
        "status": "affected",
        "version": "10.2"
      },
      {
        "status": "affected",
        "version": "10.2.1"
      },
      {
        "status": "affected",
        "version": "10.2.1.1"
      },
      {
        "status": "affected",
        "version": "10.2.2"
      },
      {
        "status": "affected",
        "version": "2"
      }
    ]
  }
]

References

www.ibm.com/support/docview.wss?uid=swg21996417

www.securityfocus.com/bid/95681

3.5 Low

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

SINGLE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:S/C:N/I:P/A:N

5.4 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

6.2 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

25.8%

JSON

Related for CVE-2016-0217

cvelist1 nvd1 ibm4 prion1