CVE-2016-0315 — Improper Access Control in IBM Jazz Reporting Service

CWE-284 — Improper Access Control3 documents3 sources
Severity
8.8HIGHNVD
EPSS
0.5%
top 35.40%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
IBM Jazz Reporting Service
Timeline
PublishedJul 8
Latest updateMay 17

Description

The Report Builder and Data Collection Component (DCC) in IBM Jazz Reporting Service (JRS) 5.x before 5.0.2 ifix016 and 6.x before 6.0.1 ifix005 maintain session ID validity after a logout action, which allows remote authenticated users to hijack sessions by leveraging an unattended workstation.

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HExploitability: 2.8 | Impact: 5.9

Affected Packages1 packages

▶NVDibm/jazz_reporting_service5 versions+4

🔴Vulnerability Details

2
GHSA
GHSA-hxq4-c433-55vx: The Report Builder and Data Collection Component (DCC) in IBM Jazz Reporting Service (JRS) 5↗2022-05-17
▶
CVEList
CVE-2016-0315: The Report Builder and Data Collection Component (DCC) in IBM Jazz Reporting Service (JRS) 5↗2016-07-08
▶
CVE-2016-0315 — Improper Access Control in IBM | cvebase