{"containers": {"cna": {"affected": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "datePublic": "2016-06-24T00:00:00", "descriptions": [{"lang": "en", "value": "Cross-site request forgery (CSRF) vulnerability in the Report Builder and Data Collection Component (DCC) in IBM Jazz Reporting Service (JRS) 5.x before 5.0.2 ifix016, 6.0 and 6.0.1 before 6.0.1 ifix005, and 6.0.2 before ifix002 allows remote authenticated users to hijack the authentication of arbitrary users."}], "problemTypes": [{"descriptions": [{"description": "n/a", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2016-11-25T19:57:01", "orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522", "shortName": "ibm"}, "references": [{"name": "91766", "tags": ["vdb-entry", "x_refsource_BID"], "url": "http://www.securityfocus.com/bid/91766"}, {"tags": ["x_refsource_CONFIRM"], "url": "http://www-01.ibm.com/support/docview.wss?uid=swg21983147"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "psirt@us.ibm.com", "ID": "CVE-2016-2889", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "n/a", "version": {"version_data": [{"version_value": "n/a"}]}}]}, "vendor_name": "n/a"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "Cross-site request forgery (CSRF) vulnerability in the Report Builder and Data Collection Component (DCC) in IBM Jazz Reporting Service (JRS) 5.x before 5.0.2 ifix016, 6.0 and 6.0.1 before 6.0.1 ifix005, and 6.0.2 before ifix002 allows remote authenticated users to hijack the authentication of arbitrary users."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "n/a"}]}]}, "references": {"reference_data": [{"name": "91766", "refsource": "BID", "url": "http://www.securityfocus.com/bid/91766"}, {"name": "http://www-01.ibm.com/support/docview.wss?uid=swg21983147", "refsource": "CONFIRM", "url": "http://www-01.ibm.com/support/docview.wss?uid=swg21983147"}]}}}}, "cveMetadata": {"assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522", "assignerShortName": "ibm", "cveId": "CVE-2016-2889", "datePublished": "2016-07-08T01:00:00", "dateReserved": "2016-03-09T00:00:00", "dateUpdated": "2016-11-25T19:57:01", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.0"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:ibm:jazz_reporting_service:5.0:*:*:*:*:*:*:*", "matchCriteriaId": "4D226029-A37F-486C-9DCD-1921671F242D", "vulnerable": true}, {"criteria": "cpe:2.3:a:ibm:jazz_reporting_service:5.0.1:*:*:*:*:*:*:*", "matchCriteriaId": "83152595-8909-4AA4-A7D1-2E113A197B1A", "vulnerable": true}, {"criteria": "cpe:2.3:a:ibm:jazz_reporting_service:5.0.2:*:*:*:*:*:*:*", "matchCriteriaId": "103F9E24-E11F-4BAC-8EDB-86D332B9EC43", "vulnerable": true}, {"criteria": "cpe:2.3:a:ibm:jazz_reporting_service:6.0:*:*:*:*:*:*:*", "matchCriteriaId": "07DD3FB3-ABE3-4645-9AFB-429EA4EA818D", "vulnerable": true}, {"criteria": "cpe:2.3:a:ibm:jazz_reporting_service:6.0.1:*:*:*:*:*:*:*", "matchCriteriaId": "FF3780DD-9FAC-4850-AA83-DCA7D013FB3E", "vulnerable": true}, {"criteria": "cpe:2.3:a:ibm:jazz_reporting_service:6.0.2:*:*:*:*:*:*:*", "matchCriteriaId": "9FCC8D80-8974-41F7-8225-474A9814ABD3", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "Cross-site request forgery (CSRF) vulnerability in the Report Builder and Data Collection Component (DCC) in IBM Jazz Reporting Service (JRS) 5.x before 5.0.2 ifix016, 6.0 and 6.0.1 before 6.0.1 ifix005, and 6.0.2 before ifix002 allows remote authenticated users to hijack the authentication of arbitrary users."}, {"lang": "es", "value": "Vulnerabilidad de CSRF en el Report Builder and Data Collection Component (DCC) en IBM Jazz Reporting Service (JRS) 5.x en versiones anteriores a 5.0.2 ifix016, 6.0 y 6.0.1 en versiones anteriores a 6.0.1 ifix005 y 6.0.2 en versiones anteriores a ifix002 permite a usuarios remotos autenticados secuestrar la autenticaci\u00f3n de usuarios arbitrarios."}], "id": "CVE-2016-2889", "lastModified": "2016-11-28T20:05:27.680", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 6.8, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "version": "2.0"}, "exploitabilityScore": 8.6, "impactScore": 6.4, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": true}], "cvssMetricV30": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.0"}, "exploitabilityScore": 2.8, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2016-07-08T01:59:10.290", "references": [{"source": "psirt@us.ibm.com", "tags": ["Vendor Advisory"], "url": "http://www-01.ibm.com/support/docview.wss?uid=swg21983147"}, {"source": "psirt@us.ibm.com", "url": "http://www.securityfocus.com/bid/91766"}], "sourceIdentifier": "psirt@us.ibm.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-352"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{}