CVE-2016-0255

IBM Marketing Platform 9.1 and 10.0 is vulnerable to stored cross-site scripting, caused by improper validation of user-supplied input. A remote attacker could exploit this vulnerability to inject malicious script into a Web page which would be executed in a victim's Web browser within the security context of the hosting Web site, once the page is viewed. An attacker could use this vulnerability to steal the victim's cookie-based authentication credentials. IBM X-Force ID: 110564.

CVSS v3 6.1 MEDIUM
CVSS v2.0 4.3 MEDIUM

6.1^/10

CVSS v3 : MEDIUM

Vector : AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Exploitability : 2.8 / Impact : 2.7

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope CHANGED

4.3^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:M/Au:N/C:N/I:P/A:N

Exploitability : 8.6 / Impact : 2.9

Access Vector NETWORK

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact NONE

Integrity Impact PARTIAL

Availability Impact NONE

References

Link	Resource
http://www.ibm.com/support/docview.wss?uid=swg22001950	Patch Vendor Advisory
http://www.securityfocus.com/bid/98336	Third Party Advisory VDB Entry
http://www.ibm.com/support/docview.wss?uid=swg22001950	Patch Vendor Advisory
http://www.securityfocus.com/bid/98336	Third Party Advisory VDB Entry

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:ibm:marketing_platform:9.1:::::::*
	cpe:2.3:a:ibm:marketing_platform:9.1.1:::::::*
	cpe:2.3:a:ibm:marketing_platform:9.1.2:::::::*
	cpe:2.3:a:ibm:marketing_platform:10.0:::::::*

History

21 Nov 2024, 02:41

Type	Values Removed	Values Added
References	~~() http://www.ibm.com/support/docview.wss?uid=swg22001950 - Patch, Vendor Advisory~~	() http://www.ibm.com/support/docview.wss?uid=swg22001950 - Patch, Vendor Advisory
References	~~() http://www.securityfocus.com/bid/98336 - Third Party Advisory, VDB Entry~~	() http://www.securityfocus.com/bid/98336 - Third Party Advisory, VDB Entry

Information

Published : 2017-05-05 19:29

Updated : 2024-11-21 02:41

NVD link : CVE-2016-0255

Mitre link : CVE-2016-0255

CVE.ORG link : CVE-2016-0255

JSON object : View

Products Affected

ibm

marketing_platform

CWE

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

{"id": "CVE-2016-0255", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 4.3, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "MEDIUM", "availabilityImpact": "NONE", "confidentialityImpact": "NONE"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.6, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": true}], "cvssMetricV30": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "CHANGED", "version": "3.0", "baseScore": 6.1, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 2.7, "exploitabilityScore": 2.8}]}, "published": "2017-05-05T19:29:00.170", "references": [{"url": "http://www.ibm.com/support/docview.wss?uid=swg22001950", "tags": ["Patch", "Vendor Advisory"], "source": "psirt@us.ibm.com"}, {"url": "http://www.securityfocus.com/bid/98336", "tags": ["Third Party Advisory", "VDB Entry"], "source": "psirt@us.ibm.com"}, {"url": "http://www.ibm.com/support/docview.wss?uid=swg22001950", "tags": ["Patch", "Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://www.securityfocus.com/bid/98336", "tags": ["Third Party Advisory", "VDB Entry"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-79"}]}], "descriptions": [{"lang": "en", "value": "IBM Marketing Platform 9.1 and 10.0 is vulnerable to stored cross-site scripting, caused by improper validation of user-supplied input. A remote attacker could exploit this vulnerability to inject malicious script into a Web page which would be executed in a victim's Web browser within the security context of the hosting Web site, once the page is viewed. An attacker could use this vulnerability to steal the victim's cookie-based authentication credentials. IBM X-Force ID: 110564."}, {"lang": "es", "value": "IBM Marketing Platform 9.1 y 10.0 es vulnerable a secuencias de comandos en sitios cruzados almacenados, provocado por la validaci\u00f3n incorrecta de la entrada suministrada por el usuario. Un atacante remoto podr\u00eda explotar la vulnerabilidad para inyectar c\u00f3digo malicioso en la p\u00e1gina web, el cual se podr\u00eda ejecutar en el navegador de la v\u00edctima en el contexto del hosting, una vez que dicha p\u00e1gina sea visualizada. Un atacante podr\u00eda utilizar esta vulnerabilidad para robar credenciales de autenticaci\u00f3n basados en cookies. IBM X-Force ID: 110564."}], "lastModified": "2024-11-21T02:41:22.210", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:ibm:marketing_platform:9.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "05558B4D-FAEB-4D25-A7BE-9946FE643200"}, {"criteria": "cpe:2.3:a:ibm:marketing_platform:9.1.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "FA58BAA3-7811-4F95-9CEF-685C9D412B98"}, {"criteria": "cpe:2.3:a:ibm:marketing_platform:9.1.2:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "1D695B1C-958A-49A9-87DE-D8A53D5B6C54"}, {"criteria": "cpe:2.3:a:ibm:marketing_platform:10.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "A394A760-E812-4D3C-9B00-F55EEA03CFB5"}], "operator": "OR"}]}], "sourceIdentifier": "psirt@us.ibm.com"}