CVE-2016-2888

MEDIUM

IBM Jazz Reporting Service - XSS

Title source: rule

Description

Cross-site scripting (XSS) vulnerability in the Report Builder and Data Collection Component (DCC) in IBM Jazz Reporting Service (JRS) 5.x before 5.0.2 ifix016 and 6.x before 6.0.1 ifix005 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL, a different vulnerability than CVE-2016-0313 and CVE-2016-0350.

References (1)

[Vendor Advisory] http://www-01.ibm.com/support/docview.wss?uid=swg21983147

Scores

CVSS v3 5.4

EPSS 0.0021

EPSS Percentile 43.7%

Attack Vector NETWORK

CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Classification

CWE

CWE-79

Status draft

Affected Products (5)

ibm/jazz_reporting_service

Timeline

Published Jul 08, 2016

Tracked Since Feb 18, 2026