CVE-2016-2963
HighSummary
CVE-2016-2963 is a CSRF vulnerability in IBM BigFix Remote Control before version 9.1.3 that allows remote attackers to hijack the authentication of arbitrary users for requests that insert XSS sequences.
Risk Assessment
Attackers can exploit this vulnerability to take control of user accounts, potentially leading to serious security breaches and data loss.
Recommendation
It is recommended to update IBM BigFix Remote Control to version 9.1.3 or later to mitigate this vulnerability.
Other vulnerabilities in IBM BigFix Remote Control
See all- CVE-2016-2930High
IBM BigFix Remote Control version 9.1.3 could allow a remote attacker to perform actions reserved for an administrator without authentication.
- CVE-2016-2948High
IBM BigFix Remote Control before 9.1.3 allows local users to discover hardcoded credentials via unspecified vectors.
- CVE-2016-2936High
IBM BigFix Remote Control before version 9.1.3 uses cleartext storage for passwords, allowing local users to obtain sensitive information.
- CVE-2016-2929High
IBM BigFix Remote Control before 9.1.3 does not properly restrict password choices, which makes it easier for remote attackers to obtain access via a brute-force approach.
- CVE-2016-2944Critical
IBM BigFix Remote Control before 9.1.3 does not properly restrict failed login attempts, making it easier for remote attackers to gain access via a brute-force approach.
Original NVD description (English source)
Cross-site request forgery (CSRF) vulnerability in IBM BigFix Remote Control before 9.1.3 allows remote attackers to hijack the authentication of arbitrary users for requests that insert XSS sequences.