Cross-Site Scripting Vulnerability in IBM Kenexa LCMS Premier on Cloud
CVE-2016-5948

5.4MEDIUM

Key Information:

Vendor

IBM
Status
Kenexa Lcms Premier On Cloud
Vendor
CVE Published:
1 February 2017

What is CVE-2016-5948?

IBM Kenexa LCMS Premier on Cloud is susceptible to a cross-site scripting issue, which allows an attacker to inject arbitrary JavaScript code into the Web UI. This vulnerability could compromise the integrity of user sessions and lead to the unauthorized disclosure of sensitive credentials. Attackers can exploit this flaw to manipulate user interactions within the trusted environment, potentially resulting in significant security breaches.

Affected Version(s)

Kenexa LCMS Premier on Cloud 9.0

Kenexa LCMS Premier on Cloud 9.1

Kenexa LCMS Premier on Cloud 9.2

References

http://www.ibm.com/support/docview.wss?uid=swg21992067
x_refsource_CONFIRM
http://www.securityfocus.com/bid/94388
vdb-entryx_refsource_BID

CVSS V3.1

Score:
5.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.