IBMB57D357D9E67F8458D2FFD3B8543C9CDBCFBD4CA3061AAE6034A3588FC2874A1Security Bulletin: IBM Security Access Manager appliances are affected by a cross-site request forgery (CSRF) vulnerability (CVE-2016-3029)
0.001 Low
EPSS
Percentile
31.1%
Summary
IBM Security Access Manager appliances are vulnerable to cross-site request forgery, which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts.
Vulnerability Details
CVEID: CVE-2016-3029**
DESCRIPTION:** IBM Security Access Manager for Web is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts.
CVSS Base Score: 4.3
CVSS Temporal Score: See <https://exchange.xforce.ibmcloud.com/vulnerabilities/114513> for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N)
Affected Products and Versions
IBM Security Access Manager for Web 8.0 appliances, all firmware versions.
IBM Security Access Manager for Mobile 8.0 appliances, all firmware versions.
IBM Security Access Manager 9.0 appliances, all firmware versions.
Remediation/Fixes
IBM has provided patches for all affected versions. Follow the installation instructions in the README files included with the patch.
| Product | VRMF | APAR | Remediation |
|---|---|---|---|
| IBM Security Access Manager for Web | 8.0.0.0 - | ||
| 8.0.1.4 | IV90674 | Upgrade to 8.0.1.5: | |
| 8.0.1-ISS-WGA-FP0005 | |||
| IBM Security Access Manager for Mobile | 8.0.0.0 - | ||
| 8.0.1.4 | IV90700 | Upgrade to 8.0.1.5: | |
| 8.0.1-ISS-ISAM-FP0005 | |||
| IBM Security Access Manager | 9.0 - 9.0.1.0 | IV90484 | Upgrade to 9.0.2.0: |
| IBM Security Access Manager V9.0.2 Multiplatform, Multilingual (CRW4EML) |
Workarounds and Mitigations
None.
Related
0.001 Low
EPSS
Percentile
31.1%