CVE-2016-3009 — Cross-Site Request Forgery in IBM Connections

CWE-352 — Cross-Site Request Forgery5 documents5 sources

Severity

3.5LOWNVD

EPSS

0.0%

top 86.64%

CISA KEV

Not in KEV

Exploit

No known exploits

Affected products

IBM Connections

Timeline

PublishedNov 30

Latest updateMay 17

Description

Cross-site request forgery (CSRF) vulnerability in IBM Connections 4.0 through CR4, 4.5 through CR5, and 5.0 before CR4 allows remote authenticated users to hijack the authentication of arbitrary users for requests that modify the Connections generic page.

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:NExploitability: 2.1 | Impact: 1.4

Affected Packages1 packages

▶NVDibm/connections4.0.0.0, 4.5.0.0, 5.0.0.0+2

🔴Vulnerability Details

GHSA

GHSA-9vmx-xr4x-44wg: Cross-site request forgery (CSRF) vulnerability in IBM Connections 4↗2022-05-17

▶

CVEList

CVE-2016-3009: Cross-site request forgery (CSRF) vulnerability in IBM Connections 4↗2016-11-30

▶

📋Vendor Advisories

Red Hat

JDK: insecure use of invoke method in CORBA component, incorrect CVE-2013-3009 fix↗2016-04-04

▶