CVE-2016-0255

{"id": "CVE-2016-0255", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 4.3, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "MEDIUM", "availabilityImpact": "NONE", "confidentialityImpact": "NONE"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.6, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": true}], "cvssMetricV30": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "CHANGED", "version": "3.0", "baseScore": 6.1, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 2.7, "exploitabilityScore": 2.8}]}, "published": "2017-05-05T19:29:00.170", "references": [{"url": "http://www.ibm.com/support/docview.wss?uid=swg22001950", "tags": ["Patch", "Vendor Advisory"], "source": "psirt@us.ibm.com"}, {"url": "http://www.securityfocus.com/bid/98336", "tags": ["Third Party Advisory", "VDB Entry"], "source": "psirt@us.ibm.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-79"}]}], "descriptions": [{"lang": "en", "value": "IBM Marketing Platform 9.1 and 10.0 is vulnerable to stored cross-site scripting, caused by improper validation of user-supplied input. A remote attacker could exploit this vulnerability to inject malicious script into a Web page which would be executed in a victim's Web browser within the security context of the hosting Web site, once the page is viewed. An attacker could use this vulnerability to steal the victim's cookie-based authentication credentials. IBM X-Force ID: 110564."}, {"lang": "es", "value": "IBM Marketing Platform 9.1 y 10.0 es vulnerable a secuencias de comandos en sitios cruzados almacenados, provocado por la validaci\u00f3n incorrecta de la entrada suministrada por el usuario. Un atacante remoto podr\u00eda explotar la vulnerabilidad para inyectar c\u00f3digo malicioso en la p\u00e1gina web, el cual se podr\u00eda ejecutar en el navegador de la v\u00edctima en el contexto del hosting, una vez que dicha p\u00e1gina sea visualizada. Un atacante podr\u00eda utilizar esta vulnerabilidad para robar credenciales de autenticaci\u00f3n basados en cookies. IBM X-Force ID: 110564."}], "lastModified": "2017-05-12T17:12:55.130", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:ibm:marketing_platform:9.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "05558B4D-FAEB-4D25-A7BE-9946FE643200"}, {"criteria": "cpe:2.3:a:ibm:marketing_platform:9.1.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "FA58BAA3-7811-4F95-9CEF-685C9D412B98"}, {"criteria": "cpe:2.3:a:ibm:marketing_platform:9.1.2:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "1D695B1C-958A-49A9-87DE-D8A53D5B6C54"}, {"criteria": "cpe:2.3:a:ibm:marketing_platform:10.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "A394A760-E812-4D3C-9B00-F55EEA03CFB5"}], "operator": "OR"}]}], "sourceIdentifier": "psirt@us.ibm.com"}