CVE-2016-9000

CWE-79 — Cross-site Scripting (XSS)CWE-201CWE-200 — Information ExposureCWE-20 — Improper Input ValidationCWE-119 — Buffer Overflow7 documents5 sources
Severity
6.1MEDIUM
EPSS
0.2%
top 52.37%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
IBM Corporation Infosphere Information ServerIBM Infosphere DatastageIBM Infosphere Information Server ON Cloud
Timeline
PublishedFeb 1
Latest updateMay 17

Description

IBM InfoSphere DataStage is vulnerable to cross-frame scripting, caused by insufficient HTML iframe protection. A remote attacker could exploit this vulnerability using a specially-crafted URL to navigate to a web page the attacker controls. An attacker could use this vulnerability to conduct clickjacking or other client-side browser attacks.

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:NExploitability: 2.8 | Impact: 2.7

Affected Packages3 packages

▶NVDibm/infosphere_datastage4 versions+3

Patches

Patch: www.ibm.com ↗Patch: www.ibm.com ↗

🔴Vulnerability Details

3
GHSA
GHSA-6f3w-94mp-xmw9: IBM InfoSphere DataStage is vulnerable to cross-frame scripting, caused by insufficient HTML iframe protection↗2022-05-17
▶
GHSA
Remote Memory Disclosure in ws↗2019-02-18
▶
CVEList
CVE-2016-9000: IBM InfoSphere DataStage is vulnerable to cross-frame scripting, caused by insufficient HTML iframe protection↗2017-02-01
▶

📋Vendor Advisories

3
Cisco
Cisco Application Policy Infrastructure Controller Denial of Service Vulnerability↗2016-11-02
▶
Cisco
Cisco Nexus 9000 Information Disclosure Vulnerability↗2016-10-05
▶
Cisco
Cisco IOS XR for Cisco ASR 9000 Series Aggregation Services Routers Interface Flap Vulnerability↗2016-04-12
▶
CVE-2016-9000 (MEDIUM CVSS 6.1) | IBM InfoSphere DataStage is vulnera | cvebase.io