Lucene search

[email protected]CVE-2016-5977

HistorySep 26, 2016 - 4:59 a.m.

CVE-2016-5977

2016-09-2604:59:33

CWE-601

[email protected]

web.nvd.nist.gov

ibm

tealeaf

customer experience

open redirect

security vulnerability

phishing attack

6.8 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:N

6.2 Medium

AI Score

Confidence

High

4.9 Medium

CVSS2

Access Vector

Access Complexity

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:S/C:P/I:P/A:N

0.001 Low

EPSS

Percentile

30.5%

JSON

Open redirect vulnerability in the web portal in IBM Tealeaf Customer Experience before 8.7.1.8847 FP10, 8.8 before 8.8.0.9049 FP9, 9.0.0 and 9.0.1 before 9.0.1.1117 FP5, 9.0.1A before 9.0.1.5108_9.0.1A FP5, 9.0.2 before 9.0.2.1223 FP3, and 9.0.2A before 9.0.2.5224_9.0.2A FP3 allows remote authenticated users to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors.

Affected configurations

NVD

Node

ibmtealeaf_customer_experienceRange≤8.7

ibmtealeaf_customer_experienceMatch8.8

ibmtealeaf_customer_experienceMatch9.0.0

ibmtealeaf_customer_experienceMatch9.0.1

ibmtealeaf_customer_experienceMatch9.0.1a

ibmtealeaf_customer_experienceMatch9.0.2

ibmtealeaf_customer_experienceMatch9.0.2a

CPENameOperatorVersion
ibm:tealeaf_customer_experienceibm tealeaf customer experiencele8.7
ibm:tealeaf_customer_experienceibm tealeaf customer experienceeq8.8
ibm:tealeaf_customer_experienceibm tealeaf customer experienceeq9.0.0
ibm:tealeaf_customer_experienceibm tealeaf customer experienceeq9.0.1
ibm:tealeaf_customer_experienceibm tealeaf customer experienceeq9.0.1a
ibm:tealeaf_customer_experienceibm tealeaf customer experienceeq9.0.2
ibm:tealeaf_customer_experienceibm tealeaf customer experienceeq9.0.2a

CPE	Name	Operator	Version
ibm:tealeaf_customer_experience	ibm tealeaf customer experience	le	8.7
ibm:tealeaf_customer_experience	ibm tealeaf customer experience	eq	8.8
ibm:tealeaf_customer_experience	ibm tealeaf customer experience	eq	9.0.0
ibm:tealeaf_customer_experience	ibm tealeaf customer experience	eq	9.0.1
ibm:tealeaf_customer_experience	ibm tealeaf customer experience	eq	9.0.1a
ibm:tealeaf_customer_experience	ibm tealeaf customer experience	eq	9.0.2
ibm:tealeaf_customer_experience	ibm tealeaf customer experience	eq	9.0.2a

References

www-01.ibm.com/support/docview.wss?uid=swg21990216

www.securityfocus.com/bid/93139

6.8 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:N

6.2 Medium

AI Score

Confidence

High

4.9 Medium

CVSS2

Access Vector

Access Complexity

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:S/C:P/I:P/A:N

0.001 Low

EPSS

Percentile

30.5%

JSON

Related for CVE-2016-5977

prion1 cvelist1 nvd1 ibm1