CVE-2016-3007
high
CVSS v3
8.8
CVSS v2
6.8
VIR risk
8.8
Description
Cross-site request forgery (CSRF) vulnerability in IBM Connections 4.x through 4.5 CR5, 5.0 before CR4, and 5.5 before CR1 allows remote authenticated users to hijack the authentication of arbitrary users.
Predictions
Exploit likelihood
92%
Patch ETA
—
Heuristic predictions, AS-IS, for prioritization only.
Mitigations
Vendor advisory: psirt@us.ibm.com — https://www-01.ibm.com/support/docview.wss?uid=swg21989067
Application impact
| Vendor | Product | Versions | Fixed |
|---|---|---|---|
| ibm | connections | 4.0.0.0 | |
| ibm | connections | 4.5.0.0 | |
| ibm | connections | 5.0.0.0 | |
| ibm | connections | 5.5.0.0 | |
References
- http://www-01.ibm.com/support/docview.wss?uid=swg1LO89962
- http://www.securityfocus.com/bid/93168
- https://www-01.ibm.com/support/docview.wss?uid=swg21989067
- http://www-01.ibm.com/support/docview.wss?uid=swg1LO89962
- http://www.securityfocus.com/bid/93168
- https://www-01.ibm.com/support/docview.wss?uid=swg21989067
CWEs
CWE-352
Verify integrity in audit chain (admin only). AS-IS.