Cross-Site Scripting Vulnerability in IBM Curam Social Program Management
CVE-2016-9980

5.4MEDIUM

Key Information:

Vendor

IBM
Status
Curam Social Program Management
Vendor
CVE Published:
20 April 2017

What is CVE-2016-9980?

IBM Curam Social Program Management versions 5.2, 6.0, and 7.0 are susceptible to a cross-site scripting vulnerability that permits users to inject arbitrary JavaScript code into the Web User Interface. This could alter the intended behavior of the application, leading to potential credential exposure during trusted sessions. Such vulnerabilities can undermine user trust and system integrity, necessitating immediate attention and remediation measures.

Affected Version(s)

Curam Social Program Management 6.0.4, 6.0.5, 6.0, 5.2, 4.5, 6.0.3, 6.1, 5.2.6, 6.0.1, 6.1.0, 6.1.1, 6.2.0, 7.0.0

References

http://www.securityfocus.com/bid/98005
vdb-entryx_refsource_BID
http://www.ibm.com/support/docview.wss?uid=swg22001779
x_refsource_CONFIRM

CVSS V3.1

Score:
5.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.