Medium severity · published Aug 8, 2016
CVE-2016-0280
Cross-site scripting (XSS) vulnerability in IBM Information Server Framework 8.5, Information Server Framework and InfoSphere Information Server Business Glossary 8.7 before FP2,…
5.4
CVSS
0.9%
EPSS
No
On KEV
Description
Cross-site scripting (XSS) vulnerability in IBM Information Server Framework 8.5, Information Server Framework and InfoSphere Information Server Business Glossary 8.7 before FP2, Information Server Framework and InfoSphere Information Server Business Glossary 9.1 before 9.1.2.0, Information Server Framework and InfoSphere Information Governance Catalog 11.3 before 11.3.1.2, and Information Server Framework and InfoSphere Information Governance Catalog 11.5 before 11.5.0.1 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL.
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.9% · higher than 59% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
IS
Information Server Framework · Ibm
8.5; 8.7; 9.1; 11.3; 11.5 · source: NVD
II
Infosphere Information Governance Catalog · Ibm
11.3; 11.5 · source: NVD
II
Infosphere Information Server Business Glossary · Ibm
8.7; 9.1 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2016-0280
CVE.org
https://www.cve.org/CVERecord?id=CVE-2016-0280
Vendor Advisory
http://www-01.ibm.com/support/docview.wss?uid=swg1JR55452
Mitigation
http://www-01.ibm.com/support/docview.wss?uid=swg21981766
www.securityfocus.com
http://www.securityfocus.com/bid/92133
www.securitytracker.com
http://www.securitytracker.com/id/1036418