Lucene search

[email protected]CVE-2016-3038

HistoryApr 17, 2017 - 9:59 p.m.

CVE-2016-3038

2017-04-1721:59:00

CWE-79

[email protected]

web.nvd.nist.gov

ibm

cognos

tm1

10.1

10.2

cross-site scripting

xss

vulnerability

web ui

javascript

credentials disclosure

5.4 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

5.6 Medium

AI Score

Confidence

High

3.5 Low

CVSS2

Access Vector

Access Complexity

Authentication

SINGLE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:S/C:N/I:P/A:N

0.0005 Low

EPSS

Percentile

18.9%

JSON

IBM Cognos TM1 10.1 and 10.2 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 114614.

Affected configurations

Vulners

NVD

Node

ibm_corporationcognos_tm1Match10.1

ibm_corporationcognos_tm1Match10.1.1

ibm_corporationcognos_tm1Match10.2.0.2

ibm_corporationcognos_tm1Match10.2.2

ibm_corporationcognos_tm1Match10.1.1.2

ibm_corporationcognos_tm1Match10.2

CPENameOperatorVersion
ibm:cognos_business_intelligenceibm cognos business intelligenceeq10.1
ibm:cognos_business_intelligenceibm cognos business intelligenceeq10.2
ibm:cognos_business_intelligenceibm cognos business intelligenceeq10.2.2

CPE	Name	Operator	Version
ibm:cognos_business_intelligence	ibm cognos business intelligence	eq	10.1
ibm:cognos_business_intelligence	ibm cognos business intelligence	eq	10.2
ibm:cognos_business_intelligence	ibm cognos business intelligence	eq	10.2.2

CNA Affected

[
  {
    "product": "Cognos TM1",
    "vendor": "IBM Corporation",
    "versions": [
      {
        "status": "affected",
        "version": "10.1"
      },
      {
        "status": "affected",
        "version": "10.1.1"
      },
      {
        "status": "affected",
        "version": "10.2.0.2"
      },
      {
        "status": "affected",
        "version": "10.2.2"
      },
      {
        "status": "affected",
        "version": "10.1.1.2"
      },
      {
        "status": "affected",
        "version": "10.2"
      }
    ]
  }
]

References

www.ibm.com/support/docview.wss?uid=swg21999649

www.securityfocus.com/bid/97915

5.4 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

5.6 Medium

AI Score

Confidence

High

3.5 Low

CVSS2

Access Vector

Access Complexity

Authentication

SINGLE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:S/C:N/I:P/A:N

0.0005 Low

EPSS

Percentile

18.9%

JSON

Related for CVE-2016-3038

cvelist1 prion1 nvd1 ibm1