CVE-2016-2901

EPSS 0.14%
Veröffentlicht 26.06.2016 01:59:02
Zuletzt bearbeitet 12.04.2025 10:46:40
Quelle psirt@us.ibm.com
Teams Watchlist Login
Unerledigt Login

Cross-site request forgery (CSRF) vulnerability in the PA_Theme_Creator application in IBM WebSphere Portal 8.5 CF08 through CF10 and Web Content Manager allows remote attackers to hijack the authentication of arbitrary users for requests that insert XSS sequences.

Betroffene Produkte Warnungen 0 Metriken 3 CWE 1 Referenzen 6

Daten sind bereitgestellt durch National Vulnerability Database (NVD)

Ibm ≫ Websphere Portal Version8.5.0.0

Ibm ≫ Web Content Manager

Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.

EPSS Metriken
Typ	Quelle	Score	Percentile
EPSS	FIRST.org	0.14%	0.31

CVSS Metriken
Quelle	Base Score	Exploit Score	Impact Score	Vector String
nvd@nist.gov	8.8	2.8	5.9	CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
nvd@nist.gov	6.8	8.6	6.4	AV:N/AC:M/Au:N/C:P/I:P/A:P

CWE-352 Cross-Site Request Forgery (CSRF)

The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.

http://www-01.ibm.com/support/docview.wss?uid=swg1PI62594

http://www-01.ibm.com/support/docview.wss?uid=swg21983974

Vendor Advisory

http://www.securitytracker.com/id/1036143

Third Party Advisory

VDB Entry

https://nvd.nist.gov/vuln/detail/CVE-2016-2901

CVE Source (NVD)

https://cveawg.mitre.org/api/cve/CVE-2016-2901

CVE Source (JSON)

https://euvd.enisa.europa.eu/vulnerability/CVE-2016-2901

EUVD