Security Bulletin: IBM Forms Experience Builder could be susceptible to a server-side request forgery (CVE-2016-6001)

Summary

IBM Forms Experience Builder could be susceptible to a server-side request forgery (SSRF) allowing for some information disclosure of internal resources.

Vulnerability Details

CVEID: CVE-2016-6001**
DESCRIPTION:** IBM Forms Experience Builder could be susceptible to a server-side request forgery (SSRF) from the application design interface allowing for some information disclosure of internal resources.
CVSS Base Score: 3.1
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/116659 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N)

Affected Products and Versions

IBM Forms Experience Builder 8.5
IBM Forms Experience Builder 8.5.1
IBM Forms Experience Builder 8.6

Remediation/Fixes

Product

| VRMF|APAR|Remediation
—|—|—|—
IBM Forms Experience Builder| 8.5.0.*| LO90583| To obtain the fix and installation assistance for these versions, contact IBM Support.
IBM Forms Experience Builder| 8.5.1| LO90583
IBM Forms Experience Builder| 8.6.0| LO90583| Download and Install 8.6.4

Workarounds and Mitigations

None