Medium severity · published Feb 1, 2017
CVE-2016-8982
IBM InfoSphere Information Server stores sensitive information in URL parameters
5.3
CVSS
1.3%
EPSS
No
On KEV
Description
IBM InfoSphere Information Server stores sensitive information in URL parameters. This may lead to information disclosure if unauthorized parties have access to the URLs via server logs, referrer header or browser history.
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
Low
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.3% · higher than 70% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
ID
Infosphere Datastage · Ibm
8.7; 9.1; 11.3 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2016-8982
CVE.org
https://www.cve.org/CVERecord?id=CVE-2016-8982
Patch
http://www.ibm.com/support/docview.wss?uid=swg21995895
Third Party Advisory
http://www.securityfocus.com/bid/95651
www.securitytracker.com
http://www.securitytracker.com/id/1037616
More from Infosphere Datastage
8.1
CVE-2016-6059
IBM InfoSphere Information Server is vulnerable to a denial of service, caused by an XML External Entity Injection (XXE) error when processing XML data
6.1
CVE-2016-9000
IBM InfoSphere DataStage is vulnerable to cross-frame scripting, caused by insufficient HTML iframe protection
5.4
CVE-2016-8999
IBM InfoSphere Information Server contains a Path-relative stylesheet import vulnerability that allows attackers to render a page in quirks mode thereby facilitating an attacker…
–
CVE-2015-1900
IBM InfoSphere DataStage 8.1, 8.5, 8.7, 9.1, and 11.3 through 11.3.1.2 on UNIX allows local users to write to executable files, and consequently obtain root privileges, via…
–
CVE-2012-0701
The client applications in the DataStage Administrator client in InfoSphere DataStage in IBM InfoSphere Information Server 8.1, 8.5 before FP3, and 8.7 rely on client-side access…