CVE-2016-9000 Cross-site scripting in InfoSphere Information Server

What is CVE-2016-9000?

CVE-2016-9000 is a medium-severity cross-site scripting vulnerability in IBM Corporation InfoSphere Information Server, published on 1 Feb 2017. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

IBM InfoSphere DataStage is vulnerable to cross-frame scripting, caused by insufficient HTML iframe protection. A remote attacker could exploit this vulnerability using a specially-crafted URL to navigate to a web page the attacker controls. An attacker could use this vulnerability to conduct clickjacking or other client-side browser attacks.

Weakness: CWE-79

Which versions are affected by CVE-2016-9000?

It affects 2 products.

Products include Ibm Infosphere Datastage, Ibm Infosphere Information Server on Cloud.

How do I fix CVE-2016-9000?

No fix has been published for CVE-2016-9000 yet. Limit exposure of the affected software until one is available.

Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.

Is CVE-2016-9000 being exploited?

There is no known exploitation of CVE-2016-9000 in the wild and no public exploit code.

Other vulnerabilities in IBM Corporation InfoSphere Information Server

• CVE-2016-6059 XML external entity in InfoSphere Information Server High 8.1
• CVE-2015-1900 Privilege escalation in n/a High 7.2
• CVE-2011-3123 Privilege escalation in n/a High 7.2
• CVE-2011-3124 Privilege escalation in n/a High 7.2
• CVE-2012-0701 Missing authorization in n/a Medium 6.5

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-6f3w-94mp-xmw9.