CVE-2016-3009

LOW

IBM Connections 4.0-4.0 CR4, 4.5-4.5 CR5, 5.0-5.0 CR3 - Authenticated Cross-Site Request Forgery

Title source: llm
STIX 2.1

Description

Cross-site request forgery (CSRF) vulnerability in IBM Connections 4.0 through CR4, 4.5 through CR5, and 5.0 before CR4 allows remote authenticated users to hijack the authentication of arbitrary users for requests that modify the Connections generic page.

References (3)

Core 3
Core References
Third Party Advisory, VDB Entry vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/94329
Vendor Advisory x_refsource_confirm
http://www-01.ibm.com/support/docview.wss?uid=swg21990864
Broken Link vendor-advisory x_refsource_aixapar
http://www-01.ibm.com/support/docview.wss?uid=swg1LO90039

Scores

CVSS v3 3.5
EPSS 0.0052
EPSS Percentile 40.6%
Attack Vector NETWORK
CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N

Details

CWE
CWE-352
Status published
Products (3)
ibm/connections 4.0.0.0
ibm/connections 4.5.0.0
ibm/connections 5.0.0.0
Published Nov 30, 2016
Tracked Since Feb 18, 2026