CVE-2016-5984

CWE-79 — Cross-site Scripting (XSS)3 documents3 sources

Severity

6.1MEDIUM

EPSS

0.2%

top 57.29%

CISA KEV

Not in KEV

Exploit

No known exploits

Affected products

IBM Corporation Infosphere Information Server IBM Infosphere Information Server IBM Infosphere Information Server ON Cloud

Timeline

PublishedFeb 1

Latest updateMay 17

Description

IBM InfoSphere Information Server is vulnerable to cross-frame scripting, caused by insufficient HTML iframe protection. A remote attacker could exploit this vulnerability using a specially-crafted URL to navigate to a web page the attacker controls. An attacker could use this vulnerability to conduct clickjacking or other client-side browser attacks.

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:NExploitability: 2.8 | Impact: 2.7

Affected Packages3 packages

▶NVDibm/infosphere_information_server4 versions+3

▶CVEListV5ibm_corporation/infosphere_information_server13 versions+12

▶NVDibm/infosphere_information11.5

Patches

Patch: www.ibm.com ↗Patch: www.ibm.com ↗

🔴Vulnerability Details

GHSA

GHSA-4h2q-wmmx-23vc: IBM InfoSphere Information Server is vulnerable to cross-frame scripting, caused by insufficient HTML iframe protection↗2022-05-17

▶

CVEList

CVE-2016-5984: IBM InfoSphere Information Server is vulnerable to cross-frame scripting, caused by insufficient HTML iframe protection↗2017-02-01

▶