Cross-Site Scripting Vulnerability in IBM Kenexa LCMS Premier on Cloud
CVE-2016-5951

5.4MEDIUM

Key Information:

Vendor
IBM
Status
Kenexa Lcms Premier On Cloud
Vendor
CVE Published:
1 February 2017

Summary

IBM Kenexa LCMS Premier on Cloud has a cross-site scripting vulnerability that permits attackers to inject malicious JavaScript code into the web user interface. This can result in altered functionality and unauthorized disclosure of sensitive information, such as user credentials, within a trusted session. The vulnerability can compromise user trust and lead to potential data breaches if not addressed.

Affected Version(s)

Kenexa LCMS Premier on Cloud 9.0

Kenexa LCMS Premier on Cloud 9.1

Kenexa LCMS Premier on Cloud 9.2

References

http://www.securityfocus.com/bid/94385
vdb-entryx_refsource_BID
http://www.ibm.com/support/docview.wss?uid=swg21992067
x_refsource_CONFIRM

CVSS V3.1

Score:
5.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.