CVE-2016-0370

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2016-0370
Cross-site scripting (XSS) vulnerability in IBM Forms Experience Builder 8.5.x and 8.6.x before 8.6.3 allows remote authenticated users to inject arbitrary web script or HTML via crafted input to an application that was built with this product.

2.7 /10

CVSS v3 : LOW

V3 Legend

Vector : AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N

Exploitability : 1.2 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required HIGH

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

3.5 /10

CVSS v2.0 : LOW

V2 Legend

Vector : AV:N/AC:M/Au:S/C:N/I:P/A:N

Exploitability : 6.8 / Impact : 2.9

Access Vector NETWORK

Access Complexity MEDIUM

Authentication SINGLE

Confidentiality Impact NONE

Integrity Impact PARTIAL

Availability Impact NONE

References
Link Resource
http://www-01.ibm.com/support/docview.wss?uid=swg1LO88449 Not Applicable
http://www-01.ibm.com/support/docview.wss?uid=swg1LO88451 Broken Link
http://www-01.ibm.com/support/docview.wss?uid=swg21988726 Patch Vendor Advisory
http://www.securityfocus.com/bid/92471
http://www-01.ibm.com/support/docview.wss?uid=swg1LO88449 Not Applicable
http://www-01.ibm.com/support/docview.wss?uid=swg1LO88451 Broken Link
http://www-01.ibm.com/support/docview.wss?uid=swg21988726 Patch Vendor Advisory
http://www.securityfocus.com/bid/92471
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:ibm:forms_experience_builder:8.5.0.0:*:*:*:*:*:*:*
cpe:2.3:a:ibm:forms_experience_builder:8.5.1.0:*:*:*:*:*:*:*
cpe:2.3:a:ibm:forms_experience_builder:8.5.1.1:*:*:*:*:*:*:*
cpe:2.3:a:ibm:forms_experience_builder:8.6.0.0:*:*:*:*:*:*:*
cpe:2.3:a:ibm:forms_experience_builder:8.6.1:*:*:*:*:*:*:*
cpe:2.3:a:ibm:forms_experience_builder:8.6.1.1:*:*:*:*:*:*:*
cpe:2.3:a:ibm:forms_experience_builder:8.6.2:*:*:*:*:*:*:*
cpe:2.3:a:ibm:forms_experience_builder:8.6.2.1:*:*:*:*:*:*:*
History

21 Nov 2024, 02:41

Type Values Removed Values Added
References () http://www-01.ibm.com/support/docview.wss?uid=swg1LO88449 - Not Applicable () http://www-01.ibm.com/support/docview.wss?uid=swg1LO88449 - Not Applicable
References () http://www-01.ibm.com/support/docview.wss?uid=swg1LO88451 - Broken Link () http://www-01.ibm.com/support/docview.wss?uid=swg1LO88451 - Broken Link
References () http://www-01.ibm.com/support/docview.wss?uid=swg21988726 - Patch, Vendor Advisory () http://www-01.ibm.com/support/docview.wss?uid=swg21988726 - Patch, Vendor Advisory
References () http://www.securityfocus.com/bid/92471 - () http://www.securityfocus.com/bid/92471 -
Information

Published : 2016-09-01 01:59

Updated : 2025-04-12 10:46

NVD link : CVE-2016-0370

Mitre link : CVE-2016-0370

CVE.ORG link : CVE-2016-0370

JSON object : View

Products Affected

ibm

  • forms_experience_builder
CWE
CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')