CVE-2016-2884 Cross-site request forgery (CSRF) vulnerability in IBM Forms Experience Builder 8.5.x and 8.6.x before 8.6.3.1, in an unspecified non-default configuration, allows remote authenticated users to hijack...
HighCVSS 8.0
EPSS 0.48%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Cross-site request forgery (CSRF) vulnerability in IBM Forms Experience Builder 8.5.x and 8.6.x before 8.6.3.1, in an unspecified non-default configuration, allows remote authenticated users to hijack the authentication of arbitrary users for requests that insert XSS sequences.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| ibm forms experience builder | = 8.5.0.0 | No fix listed |
| ibm forms experience builder | = 8.5.1.0 | No fix listed |
| ibm forms experience builder | = 8.5.1.1 | No fix listed |
| ibm forms experience builder | = 8.6.0.0 | No fix listed |
| ibm forms experience builder | = 8.6.1 | No fix listed |
| ibm forms experience builder | = 8.6.1.1 | No fix listed |
| ibm forms experience builder | = 8.6.2 | No fix listed |
| ibm forms experience builder | = 8.6.2.1 | No fix listed |
| ibm forms experience builder | = 8.6.3 | No fix listed |
References
- LO89686 not-applicable vendor-advisory
- www-01.ibm.com patch vendor-advisory