CVE-2016-2998
low
CVSS v3
3.5
CVSS v2
3.5
VIR risk
3.5
Description
Cross-site request forgery (CSRF) vulnerability in IBM Connections 4.0 through CR4, 4.5 through CR5, 5.0 before CR4, and 5.5 before CR1 allows remote authenticated users to hijack the authentication of arbitrary users for requests that update data.
Predictions
Exploit likelihood
45%
Patch ETA
—
Heuristic predictions, AS-IS, for prioritization only.
Mitigations
Vendor advisory: psirt@us.ibm.com — http://www-01.ibm.com/support/docview.wss?uid=swg21988991
Application impact
| Vendor | Product | Versions | Fixed |
|---|---|---|---|
| ibm | connections | 4.0.0.0 | |
| ibm | connections | 4.5.0.0 | |
| ibm | connections | 5.0.0.0 | |
| ibm | connections | 5.5.0.0 | |
References
- http://www-01.ibm.com/support/docview.wss?uid=swg1LO89929
- http://www-01.ibm.com/support/docview.wss?uid=swg21988991
- http://www.securityfocus.com/bid/92578
- http://www-01.ibm.com/support/docview.wss?uid=swg1LO89929
- http://www-01.ibm.com/support/docview.wss?uid=swg21988991
- http://www.securityfocus.com/bid/92578
CWEs
CWE-352
Verify integrity in audit chain (admin only). AS-IS.