CVE-2016-3001

MEDIUM

IBM Connections - XSS

Title source: rule

Description

Cross-site scripting (XSS) vulnerability in the Web UI in IBM Connections 4.x through 4.5 CR5, 5.0 before CR4, and 5.5 before CR1 allows remote authenticated users to inject arbitrary web script or HTML via an embedded string, a different vulnerability than CVE-2016-3003 and CVE-2016-3006.

References (3)

[Broken Link] http://www-01.ibm.com/support/docview.wss?uid=swg1LO89962

[Patch, Vendor Advisory] https://www-01.ibm.com/support/docview.wss?uid=swg21989067

[Third Party Advisory, VDB Entry] http://www.securityfocus.com/bid/93172

Scores

CVSS v3 5.4

EPSS 0.0020

EPSS Percentile 41.8%

Attack Vector NETWORK

CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Classification

CWE

CWE-79

Status published

Affected Products (5)

ibm/connections

n/a/n/a

Timeline

Published Sep 26, 2016

Tracked Since Feb 18, 2026