CVE-2015-5035

MEDIUM

IBM Connections < 3.0.1.1 - Authenticated Cross-Site Scripting via Crafted URL

Title source: llm
STIX 2.1

Description

Cross-site scripting (XSS) vulnerability in IBM Connections 3.x before 3.0.1.1 CR3, 4.0 before CR4, 4.5 before CR5, and 5.0 before CR3 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL, a different vulnerability than CVE-2015-5036.

References (2)

Core 2
Core References
Vendor Advisory x_refsource_confirm
http://www-01.ibm.com/support/docview.wss?uid=swg21971439
Various Sources vendor-advisory x_refsource_aixapar
http://www-01.ibm.com/support/docview.wss?uid=swg1LO87020

Scores

CVSS v3 5.4
EPSS 0.0066
EPSS Percentile 47.7%
Attack Vector NETWORK
CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Details

CWE
CWE-79
Status published
Products (4)
ibm/connections 4.0
ibm/connections 4.5
ibm/connections 5.0
ibm/connections < 3.0.1.1
Published Jan 03, 2016
Tracked Since Feb 18, 2026