CVE-2016-8982 Information disclosure in InfoSphere DataStage

What is CVE-2016-8982?

CVE-2016-8982 is a medium-severity vulnerability in IBM Corporation InfoSphere DataStage, published on 1 Feb 2017. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

IBM InfoSphere Information Server stores sensitive information in URL parameters. This may lead to information disclosure if unauthorized parties have access to the URLs via server logs, referrer header or browser history.

Weakness: CWE-200

Which versions are affected by CVE-2016-8982?

It affects 1 product.

Products include Ibm Infosphere Datastage.

How do I fix CVE-2016-8982?

No fix has been published for CVE-2016-8982 yet. Limit exposure of the affected software until one is available.

Is CVE-2016-8982 being exploited?

There is no known exploitation of CVE-2016-8982 in the wild and no public exploit code.

Other vulnerabilities in IBM Corporation InfoSphere DataStage

• CVE-2016-6059 XML external entity in InfoSphere Information Server High 8.1
• CVE-2015-1900 Privilege escalation in n/a High 7.2
• CVE-2011-3123 Privilege escalation in n/a High 7.2
• CVE-2011-3124 Privilege escalation in n/a High 7.2
• CVE-2012-0701 Missing authorization in n/a Medium 6.5

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-86gw-59mw-3ww4.