CVE-2016-2889
HighSummary
CSRF vulnerability in Report Builder and Data Collection Component (DCC) in IBM Jazz Reporting Service (JRS) allows remote authenticated users to hijack the authentication of arbitrary users. This affects versions 5.x before 5.0.2 ifix016, 6.0 and 6.0.1 before 6.0.1 ifix005, and 6.0.2 before ifix002.
Risk Assessment
Session hijacking can lead to unauthorized access to system data and functions, posing a serious security threat to the organization.
Recommendation
It is recommended to update to the latest version of IBM Jazz Reporting Service to mitigate this vulnerability and implement additional protections against CSRF attacks.
Other vulnerabilities in IBM Jazz Reporting Service (JRS)
See all- CVE-2015-7464High
Report Builder in IBM Jazz Reporting Service (JRS) versions 5.x before 5.0.2-Rational-CLM-ifix011 and 6.0 before 6.0.0-Rational-CLM-ifix005 is vulnerable to an attack that can cause a Report Builder server outage via a crafted request to a Report Builder instance URL.
- CVE-2015-7470High
Report Builder in IBM Jazz Reporting Service (JRS) 5.x before 5.0.2-Rational-CLM-ifix011 and 6.0 before 6.0.0-Rational-CLM-ifix005 is vulnerable to man-in-the-middle attacks, allowing attackers to obtain sensitive information, including login credentials.
- CVE-2015-7465High
CSRF vulnerability in Lifecycle Query Engine (LQE) in IBM Jazz Reporting Service (JRS) 6.0 before version 6.0.0-Rational-CLM-ifix005 allows remote authenticated users to hijack the authentication of arbitrary users for requests that insert XSS sequences.
Original NVD description (English source)
Cross-site request forgery (CSRF) vulnerability in the Report Builder and Data Collection Component (DCC) in IBM Jazz Reporting Service (JRS) 5.x before 5.0.2 ifix016, 6.0 and 6.0.1 before 6.0.1 ifix005, and 6.0.2 before ifix002 allows remote authenticated users to hijack the authentication of arbitrary users.