CVE-2016-2888

MEDIUM

IBM Jazz Reporting Service 5.x-6.x - Authenticated Cross-Site Scripting via Report Builder and Data Collection Component

Title source: llm
STIX 2.1

Description

Cross-site scripting (XSS) vulnerability in the Report Builder and Data Collection Component (DCC) in IBM Jazz Reporting Service (JRS) 5.x before 5.0.2 ifix016 and 6.x before 6.0.1 ifix005 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL, a different vulnerability than CVE-2016-0313 and CVE-2016-0350.

References (1)

Core 1
Core References
Vendor Advisory x_refsource_confirm
http://www-01.ibm.com/support/docview.wss?uid=swg21983147

Scores

CVSS v3 5.4
EPSS 0.0075
EPSS Percentile 51.0%
Attack Vector NETWORK
CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Details

CWE
CWE-79
Status published
Products (5)
ibm/jazz_reporting_service 5.0
ibm/jazz_reporting_service 5.0.1
ibm/jazz_reporting_service 5.0.2
ibm/jazz_reporting_service 6.0
ibm/jazz_reporting_service 6.0.1
Published Jul 08, 2016
Tracked Since Feb 18, 2026