CVE-2016-3007

High

Published: 26/09/2016(UTC)Translated: 15/06/2026(UTC)NVD NIST

Summary

CVE-2016-3007 describes a CSRF vulnerability in IBM Connections versions 4.x through 4.5 CR5, 5.0 before CR4, and 5.5 before CR1 that allows remote authenticated users to hijack the authentication of arbitrary users.

Risk Assessment

Organizations may be at risk of session hijacking, which could lead to unauthorized access to system data and functions.

Recommendation

It is recommended to upgrade to the latest version of IBM Connections to mitigate this vulnerability and implement additional security measures against CSRF attacks.

Other vulnerabilities in IBM Connections

CVE-2015-5038High
IBM Connections versions 3.x before 3.0.1.1 CR3, 4.0 before CR4, 4.5 before CR5, and 5.0 before CR3 do not properly detect recursion during XML entity expansion. This allows remote attackers to cause a denial of service via a crafted XML document containing a large number of nested entity references.

Original NVD description (English source)

Cross-site request forgery (CSRF) vulnerability in IBM Connections 4.x through 4.5 CR5, 5.0 before CR4, and 5.5 before CR1 allows remote authenticated users to hijack the authentication of arbitrary users.