High severity · published Jul 3, 2016
CVE-2016-2863
Cross-site request forgery (CSRF) vulnerability in IBM WebSphere Commerce 7.0 Feature Pack 8, 8.0.0.x before 8.0.0.10, and 8.0.1.x before 8.0.1.2 allows remote authenticated users…
8.0
CVSS
0.6%
EPSS
No
On KEV
Description
Cross-site request forgery (CSRF) vulnerability in IBM WebSphere Commerce 7.0 Feature Pack 8, 8.0.0.x before 8.0.0.10, and 8.0.1.x before 8.0.1.2 allows remote authenticated users to hijack the authentication of arbitrary users for requests that insert XSS sequences.
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
Required
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.6% · higher than 46% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
WC
Websphere Commerce · Ibm
7.0; 8.0.0.0; 8.0.0.1; 8.0.0.2; 8.0.0.3; 8.0.0.5; +4 more · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2016-2863
CVE.org
https://www.cve.org/CVERecord?id=CVE-2016-2863
www-01.ibm.com
http://www-01.ibm.com/support/docview.wss?uid=swg1JR55776
Vendor Advisory
http://www-01.ibm.com/support/docview.wss?uid=swg21983626
www.securityfocus.com
http://www.securityfocus.com/bid/91544
www.securitytracker.com
http://www.securitytracker.com/id/1036219
More from Websphere Commerce
9.8
CVE-2016-6090
IBM WebSphere Commerce contains an unspecified vulnerability that could allow disclosure of user personal data, performing of unauthorized administrative operations, and…
8.8
CVE-2018-1808
IBM WebSphere Commerce 9.0.0.0 through 9.0.0.6 could allow some server-side code injection due to inadequate input control
8.8
CVE-2015-5007
Cross-site request forgery (CSRF) vulnerability in IBM WebSphere Commerce 6.0 through 6.0.0.11, 7.0 through 7.0.0.9, and 7.0 Feature Pack 8 allows remote authenticated users to…
7.5
CVE-2017-1569
IBM WebSphere Commerce 7.0 and 8.0 contains an unspecified vulnerability in Marketing ESpot's that could cause a denial of service
7.4
CVE-2015-7397
Multiple open redirect vulnerabilities in the Aurora starter store in IBM WebSphere Commerce 7.0 through Feature Pack 8 allow remote attackers to redirect users to arbitrary web…