CVE-2015-7465
HighSummary
CSRF vulnerability in Lifecycle Query Engine (LQE) in IBM Jazz Reporting Service (JRS) 6.0 before version 6.0.0-Rational-CLM-ifix005 allows remote authenticated users to hijack the authentication of arbitrary users for requests that insert XSS sequences.
Risk Assessment
The organization may be exposed to attacks that allow session hijacking of users, potentially leading to unauthorized access to system data and functions.
Recommendation
It is recommended to upgrade to version 6.0.0-Rational-CLM-ifix005 or later to mitigate this vulnerability.
Other vulnerabilities in IBM Jazz Reporting Service (JRS) 6.0
See all- CVE-2016-2889High
CSRF vulnerability in Report Builder and Data Collection Component (DCC) in IBM Jazz Reporting Service (JRS) allows remote authenticated users to hijack the authentication of arbitrary users. This affects versions 5.x before 5.0.2 ifix016, 6.0 and 6.0.1 before 6.0.1 ifix005, and 6.0.2 before ifix002.
- CVE-2015-7464High
Report Builder in IBM Jazz Reporting Service (JRS) versions 5.x before 5.0.2-Rational-CLM-ifix011 and 6.0 before 6.0.0-Rational-CLM-ifix005 is vulnerable to an attack that can cause a Report Builder server outage via a crafted request to a Report Builder instance URL.
- CVE-2015-7470High
Report Builder in IBM Jazz Reporting Service (JRS) 5.x before 5.0.2-Rational-CLM-ifix011 and 6.0 before 6.0.0-Rational-CLM-ifix005 is vulnerable to man-in-the-middle attacks, allowing attackers to obtain sensitive information, including login credentials.
Original NVD description (English source)
Cross-site request forgery (CSRF) vulnerability in Lifecycle Query Engine (LQE) in IBM Jazz Reporting Service (JRS) 6.0 before 6.0.0-Rational-CLM-ifix005 allows remote authenticated users to hijack the authentication of arbitrary users for requests that insert XSS sequences.