8.8
CVE-2016-0295
- EPSS 1.05%
- Veröffentlicht 28.02.2018 17:29:00
- Zuletzt bearbeitet 21.11.2024 02:41:26
- Quelle psirt@us.ibm.com
- CVE-Watchlists
- Unerledigt
LoginCross-site request forgery (CSRF) vulnerability in the IBM BigFix Platform 9.0, 9.1, 9.2, and 9.5 before 9.5.2 allows remote attackers to hijack the authentication of arbitrary users for requests that insert XSS sequences. IBM X-Force ID: 111363.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Ibm ≫ Bigfix Platform Version >= 9.5 < 9.5.2
Ibm ≫ Bigfix Platform Version9.0
Ibm ≫ Bigfix Platform Version9.1
Ibm ≫ Bigfix Platform Version9.2
| Typ | Quelle | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 1.05% | 0.597 |
| Quelle | Base Score | Exploit Score | Impact Score | Vector String |
|---|---|---|---|---|
| nvd@nist.gov | 8.8 | 2.8 | 5.9 |
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
|
| nvd@nist.gov | 6.8 | 8.6 | 6.4 |
AV:N/AC:M/Au:N/C:P/I:P/A:P
|
CWE-352 Cross-Site Request Forgery (CSRF)
The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.
http://www-01.ibm.com/support/docview.wss?uid=swg21985830
https://exchange.xforce.ibmcloud.com/vulnerabilities/111363