CVE-2015-5007
HighSummary
The CSRF vulnerability in IBM WebSphere Commerce allows remote authenticated users to hijack the authentication of arbitrary users for requests that insert XSS sequences. It affects versions 6.0 through 6.0.0.11 and 7.0 through 7.0.0.9 and 7.0 Feature Pack 8.
Risk Assessment
The organization may be exposed to attacks that allow session hijacking, potentially leading to unauthorized access to application data and functions.
Recommendation
It is recommended to upgrade to the latest version of IBM WebSphere Commerce to mitigate this vulnerability and implement additional protections against CSRF attacks.
Other vulnerabilities in IBM WebSphere Commerce
See all- CVE-2014-0943High
IBM WebSphere Commerce versions 6.0 Feature Pack 2 through 5, 7.0.0.0 through 7.0.0.8, and 7.0 Feature Pack 1 through 7 allow remote attackers to cause a denial of service (resource consumption and daemon crash) via a malformed id parameter in a request.
- CVE-2016-6090Critical
IBM WebSphere Commerce contains an unspecified vulnerability that could allow disclosure of user personal data, performing unauthorized administrative operations, and potentially causing a denial of service.
Original NVD description (English source)
Cross-site request forgery (CSRF) vulnerability in IBM WebSphere Commerce 6.0 through 6.0.0.11, 7.0 through 7.0.0.9, and 7.0 Feature Pack 8 allows remote authenticated users to hijack the authentication of arbitrary users for requests that insert XSS sequences.