VIR Vulnerability Intelligence Relay

CVE-2016-0315

high
Published 2016-07-08 · Modified 2026-05-06
CVSS v3
8.8
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v2
6.5
VIR risk
8.8

Description

The Report Builder and Data Collection Component (DCC) in IBM Jazz Reporting Service (JRS) 5.x before 5.0.2 ifix016 and 6.x before 6.0.1 ifix005 maintain session ID validity after a logout action, which allows remote authenticated users to hijack sessions by leveraging an unattended workstation.

Predictions

Exploit likelihood
92%
Patch ETA
—

Heuristic predictions, AS-IS, for prioritization only.

Mitigations

vendor Authored 2026-05-27

Vendor advisory: psirt@us.ibm.com — http://www-01.ibm.com/support/docview.wss?uid=swg21983147

Application impact
VendorProductVersionsFixed
ibm ibmjazz_reporting_service5.0
ibm ibmjazz_reporting_service5.0.1
ibm ibmjazz_reporting_service5.0.2
ibm ibmjazz_reporting_service6.0
ibm ibmjazz_reporting_service6.0.1

References

CWEs

CWE-284

Verify integrity in audit chain (admin only). AS-IS.