Vulnerability Details : CVE-2016-2862
Cross-site scripting (XSS) vulnerability in IBM WebSphere Commerce 6.0 through 6.0.0.11, 7.0 before 7.0.0.9 cumulative iFix 3, and 8.0 before 8.0.0.5 allows remote attackers to inject arbitrary web script or HTML via a crafted URL.
Vulnerability category: Cross site scripting (XSS)
Products affected by CVE-2016-2862
- cpe:2.3:a:ibm:websphere_commerce:6.0.0.2:*:*:*:*:*:*:*
- cpe:2.3:a:ibm:websphere_commerce:6.0.0.4:*:*:*:*:*:*:*
- cpe:2.3:a:ibm:websphere_commerce:6.0.0.1:*:*:*:*:*:*:*
- cpe:2.3:a:ibm:websphere_commerce:6.0.0.5:*:*:*:*:*:*:*
- cpe:2.3:a:ibm:websphere_commerce:6.0.0.3:*:*:*:*:*:*:*
- cpe:2.3:a:ibm:websphere_commerce:6.0.0.6:*:*:*:*:*:*:*
- cpe:2.3:a:ibm:websphere_commerce:7.0:*:*:*:*:*:*:*
- cpe:2.3:a:ibm:websphere_commerce:6.0.0.7:*:*:*:*:*:*:*
- cpe:2.3:a:ibm:websphere_commerce:6.0.0.8:*:*:*:*:*:*:*
- cpe:2.3:a:ibm:websphere_commerce:6.0.0.9:*:*:*:*:*:*:*
- cpe:2.3:a:ibm:websphere_commerce:6.0.0.0:*:*:*:*:*:*:*
- cpe:2.3:a:ibm:websphere_commerce:6.0.0.10:*:*:*:*:*:*:*
- cpe:2.3:a:ibm:websphere_commerce:6.0.0.11:*:*:*:*:*:*:*
- cpe:2.3:a:ibm:websphere_commerce:7.0.0.1:*:*:*:*:*:*:*
- cpe:2.3:a:ibm:websphere_commerce:7.0.0.2:*:*:*:*:*:*:*
- cpe:2.3:a:ibm:websphere_commerce:7.0.0.3:*:*:*:*:*:*:*
- cpe:2.3:a:ibm:websphere_commerce:7.0.0.4:*:*:*:*:*:*:*
- cpe:2.3:a:ibm:websphere_commerce:7.0.0.5:*:*:*:*:*:*:*
- cpe:2.3:a:ibm:websphere_commerce:7.0.0.6:*:*:*:*:*:*:*
- cpe:2.3:a:ibm:websphere_commerce:7.0.0.7:*:*:*:*:*:*:*
- cpe:2.3:a:ibm:websphere_commerce:7.0.0.8:*:*:*:*:*:*:*
- cpe:2.3:a:ibm:websphere_commerce:7.0.0.9:*:*:*:*:*:*:*
- cpe:2.3:a:ibm:websphere_commerce:8.0.0.0:*:*:*:*:*:*:*
- cpe:2.3:a:ibm:websphere_commerce:8.0.0.2:*:*:*:*:*:*:*
- cpe:2.3:a:ibm:websphere_commerce:8.0.0.1:*:*:*:*:*:*:*
- cpe:2.3:a:ibm:websphere_commerce:8.0.0.3:*:*:*:*:*:*:*
- cpe:2.3:a:ibm:websphere_commerce:8.0.0.4:*:*:*:*:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2016-2862
0.43%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 60 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2016-2862
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
4.3
|
MEDIUM | AV:N/AC:M/Au:N/C:N/I:P/A:N |
8.6
|
2.9
|
NIST | |
|
6.1
|
MEDIUM | CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N |
2.8
|
2.7
|
NIST |
CWE ids for CVE-2016-2862
-
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.Assigned by: nvd@nist.gov (Primary)
References for CVE-2016-2862
-
http://www-01.ibm.com/support/docview.wss?uid=swg1JR55049
IBM JR55049: WebSphere Commerce cumulative iFix #3 for Fix Pack 9 and cumulative iFix #2 for Feature Pack 8Patch
-
http://www.securityfocus.com/bid/91533
IBM WebSphere Commerce CVE-2016-2862 Unspecified Cross Site Scripting Vulnerability
-
http://www-01.ibm.com/support/docview.wss?uid=swg21983625
IBM Security Bulletin: Cross Site Scripting (XSS) security vulnerabilities in IBM WebSphere Commerce (CVE-2016-2862)Patch;Vendor Advisory
-
http://www-01.ibm.com/support/docview.wss?uid=swg1JR55264
IBM notice: The page you requested cannot be displayed
-
http://www-01.ibm.com/support/docview.wss?uid=swg1JR55141
IBM notice: The page you requested cannot be displayed
-
http://www-01.ibm.com/support/docview.wss?uid=swg1JR55139
IBM notice: The page you requested cannot be displayed
-
http://www.securitytracker.com/id/1036206
IBM WebSphere Commerce Input Validation Flaw in Store Pages Lets Remote Conduct Cross-Site Scripting Attacks - SecurityTracker
Jump to