Security Bulletin: Multiple Security Vulnerabilities have been addressed in LCMS Premier on Cloud 10.1

Summary

Multiple Security Vulnerabilities have been addressed in LCMS Premier on Cloud 10.1

Vulnerability Details

Relevant CVE Information:

CVEID: CVE-2016-5952**
DESCRIPTION:** IBM Kenexa LCMS Premier on Cloud is vulnerable to SQL injection. A remote attacker could send specially-crafted SQL statements, which could allow the attacker to view, add, modify or delete information in the back-end database.
CVSS Base Score: 6.3
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/116097 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L)

CVEID: CVE-2016-9994**
DESCRIPTION:** IBM Kenexa LCMS Premier on Cloud is vulnerable to SQL injection. A remote attacker could send specially-crafted SQL statements, which could allow the attacker to view, add, modify or delete information in the back-end database.
CVSS Base Score: 7.1
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/121318 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N)

Affected Products and Versions

IBM Kenexa LCMS Premier 9.0, 9.1, 9.2, 9.2.1, 9.3, 9.4, 9.5, 10.0

Remediation/Fixes

This issue has been addressed in IBM Kenexa LCMS Premier 10.1

Customers who are using an affected version should visit IBM Support Portal and open a Service Request (SR) to request an upgrade to latest fixed release.

<https://www-947.ibm.com/support/entry/portal&gt;