CVE-2016-0293 - Vulnerability Details

Vendors	Products
Ibm	Bigfix Platform

Link	Providers
http://www-01.ibm.com/support/docview.wss?uid=swg21985743
http://www.securityfocus.com/bid/92593

Show plain JSON

{"containers": {"cna": {"affected": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "datePublic": "2016-07-09T00:00:00", "descriptions": [{"lang": "en", "value": "Cross-site scripting (XSS) vulnerability in IBM BigFix Platform (formerly Tivoli Endpoint Manager) 9.x before 9.1.8 and 9.2.x before 9.2.8 allows remote attackers to inject arbitrary web script or HTML via a modified .beswrpt file."}], "problemTypes": [{"descriptions": [{"description": "n/a", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2016-11-25T19:57:01", "orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522", "shortName": "ibm"}, "references": [{"tags": ["x_refsource_CONFIRM"], "url": "http://www-01.ibm.com/support/docview.wss?uid=swg21985743"}, {"name": "92593", "tags": ["vdb-entry", "x_refsource_BID"], "url": "http://www.securityfocus.com/bid/92593"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "psirt@us.ibm.com", "ID": "CVE-2016-0293", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "n/a", "version": {"version_data": [{"version_value": "n/a"}]}}]}, "vendor_name": "n/a"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "Cross-site scripting (XSS) vulnerability in IBM BigFix Platform (formerly Tivoli Endpoint Manager) 9.x before 9.1.8 and 9.2.x before 9.2.8 allows remote attackers to inject arbitrary web script or HTML via a modified .beswrpt file."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "n/a"}]}]}, "references": {"reference_data": [{"name": "http://www-01.ibm.com/support/docview.wss?uid=swg21985743", "refsource": "CONFIRM", "url": "http://www-01.ibm.com/support/docview.wss?uid=swg21985743"}, {"name": "92593", "refsource": "BID", "url": "http://www.securityfocus.com/bid/92593"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-05T22:15:23.312Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "http://www-01.ibm.com/support/docview.wss?uid=swg21985743"}, {"name": "92593", "tags": ["vdb-entry", "x_refsource_BID", "x_transferred"], "url": "http://www.securityfocus.com/bid/92593"}]}]}, "cveMetadata": {"assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522", "assignerShortName": "ibm", "cveId": "CVE-2016-0293", "datePublished": "2016-09-01T01:00:00", "dateReserved": "2015-12-08T00:00:00", "dateUpdated": "2024-08-05T22:15:23.312Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{

containers : { »

cna : { »

affected : [ »

0 : { »

product : n/a (string)

vendor : n/a (string)

versions : [ »

0 : { »

status : affected (string)

version : n/a (string)

}

]

}

]

datePublic : 2016-07-09T00:00:00 (string)

descriptions : [ »

0 : { »

lang : en (string)

value : Cross-site scripting (XSS) vulnerability in IBM BigFix Platform (formerly Tivoli Endpoint Manager) 9.x before 9.1.8 and 9.2.x before 9.2.8 allows remote attackers to inject arbitrary web script or HTML via a modified .beswrpt file. (string)

}

]

problemTypes : [ »

0 : { »

descriptions : [ »

0 : { »

description : n/a (string)

lang : en (string)

type : text (string)

}

]

}

]

providerMetadata : { »

dateUpdated : 2016-11-25T19:57:01 (string)

orgId : 9a959283-ebb5-44b6-b705-dcc2bbced522 (string)

shortName : ibm (string)

}

references : [ »

0 : { »

tags : [ »

0 : x_refsource_CONFIRM (string)

]

url : http://www-01.ibm.com/support/docview.wss?uid=swg21985743 (string)

}

1 : { »

name : 92593 (string)

tags : [ »

0 : vdb-entry (string)

1 : x_refsource_BID (string)

]

url : http://www.securityfocus.com/bid/92593 (string)

}

]

x_legacyV4Record : { »

CVE_data_meta : { »

ASSIGNER : psirt@us.ibm.com (string)

ID : CVE-2016-0293 (string)

STATE : PUBLIC (string)

}

affects : { »

vendor : { »

vendor_data : [ »

0 : { »

product : { »

product_data : [ »

0 : { »

product_name : n/a (string)

version : { »

version_data : [ »

0 : { »

version_value : n/a (string)

}

]

}

]

}

vendor_name : n/a (string)

}

]

}

data_format : MITRE (string)

data_type : CVE (string)

data_version : 4.0 (string)

description : { »

description_data : [ »

0 : { »

lang : eng (string)

value : Cross-site scripting (XSS) vulnerability in IBM BigFix Platform (formerly Tivoli Endpoint Manager) 9.x before 9.1.8 and 9.2.x before 9.2.8 allows remote attackers to inject arbitrary web script or HTML via a modified .beswrpt file. (string)

}

]

}

problemtype : { »

problemtype_data : [ »

0 : { »

description : [ »

0 : { »

lang : eng (string)

value : n/a (string)

}

]

}

]

}

references : { »

reference_data : [ »

0 : { »

name : http://www-01.ibm.com/support/docview.wss?uid=swg21985743 (string)

refsource : CONFIRM (string)

url : http://www-01.ibm.com/support/docview.wss?uid=swg21985743 (string)

}

1 : { »

name : 92593 (string)

refsource : BID (string)

url : http://www.securityfocus.com/bid/92593 (string)

}

]

}

adp : [ »

0 : { »

providerMetadata : { »

orgId : af854a3a-2127-422b-91ae-364da2661108 (string)

shortName : CVE (string)

dateUpdated : 2024-08-05T22:15:23.312Z (string)

}

title : CVE Program Container (string)

references : [ »

0 : { »

tags : [ »

0 : x_refsource_CONFIRM (string)

1 : x_transferred (string)

]

url : http://www-01.ibm.com/support/docview.wss?uid=swg21985743 (string)

}

1 : { »

name : 92593 (string)

tags : [ »

0 : vdb-entry (string)

1 : x_refsource_BID (string)

2 : x_transferred (string)

]

url : http://www.securityfocus.com/bid/92593 (string)

}

]

}

]

}

cveMetadata : { »

assignerOrgId : 9a959283-ebb5-44b6-b705-dcc2bbced522 (string)

assignerShortName : ibm (string)

cveId : CVE-2016-0293 (string)

datePublished : 2016-09-01T01:00:00 (string)

dateReserved : 2015-12-08T00:00:00 (string)

dateUpdated : 2024-08-05T22:15:23.312Z (string)

state : PUBLISHED (string)

}

dataType : CVE_RECORD (string)

dataVersion : 5.1 (string)

}

Show plain JSON

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:ibm:bigfix_platform:9.2.0:*:*:*:*:*:*:*", "matchCriteriaId": "33D2F8B3-CCDD-4C4D-8790-4468A15D32AD", "vulnerable": true}, {"criteria": "cpe:2.3:a:ibm:bigfix_platform:9.2.1:*:*:*:*:*:*:*", "matchCriteriaId": "3E47D31B-7665-416E-9220-7DC02B4BC298", "vulnerable": true}, {"criteria": "cpe:2.3:a:ibm:bigfix_platform:9.2.2:*:*:*:*:*:*:*", "matchCriteriaId": "BF7890CF-0008-48BA-8A04-FCFFC0C1B01B", "vulnerable": true}, {"criteria": "cpe:2.3:a:ibm:bigfix_platform:9.2.3:*:*:*:*:*:*:*", "matchCriteriaId": "4442C0AA-DE96-4040-B907-2B10167B18AC", "vulnerable": true}, {"criteria": "cpe:2.3:a:ibm:bigfix_platform:9.2.4:*:*:*:*:*:*:*", "matchCriteriaId": "AB5419C4-A2C6-417E-8EE4-A797579A2B1E", "vulnerable": true}, {"criteria": "cpe:2.3:a:ibm:bigfix_platform:9.2.5:*:*:*:*:*:*:*", "matchCriteriaId": "FF8C1B44-1283-441B-9AAB-B95C7DC80255", "vulnerable": true}, {"criteria": "cpe:2.3:a:ibm:bigfix_platform:9.2.6:*:*:*:*:*:*:*", "matchCriteriaId": "35FE1605-0746-4A94-A643-5187CBEAE596", "vulnerable": true}, {"criteria": "cpe:2.3:a:ibm:bigfix_platform:9.2.7:*:*:*:*:*:*:*", "matchCriteriaId": "5F6565DE-ACFA-41E7-8761-1C1BC8A301BF", "vulnerable": true}], "negate": false, "operator": "OR"}]}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:ibm:bigfix_platform:9.0.5:*:*:*:*:*:*:*", "matchCriteriaId": "DBF00DCA-80E9-4F8E-A0D6-9806206ECF58", "vulnerable": true}, {"criteria": "cpe:2.3:a:ibm:bigfix_platform:9.0.6:*:*:*:*:*:*:*", "matchCriteriaId": "3D9726F3-7DCE-4811-ADA3-CC517BD56123", "vulnerable": true}, {"criteria": "cpe:2.3:a:ibm:bigfix_platform:9.0.7:*:*:*:*:*:*:*", "matchCriteriaId": "8172EA9A-41B1-4FC3-9BF8-A6A2744AA8BE", "vulnerable": true}, {"criteria": "cpe:2.3:a:ibm:bigfix_platform:9.0.8:*:*:*:*:*:*:*", "matchCriteriaId": "24A0AD9E-5753-48A5-B049-791564328E6D", "vulnerable": true}], "negate": false, "operator": "OR"}]}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:ibm:bigfix_platform:9.1.3:*:*:*:*:*:*:*", "matchCriteriaId": "44A36BD8-D35C-4FDE-9CFC-455728F61F3F", "vulnerable": true}, {"criteria": "cpe:2.3:a:ibm:bigfix_platform:9.1.4:*:*:*:*:*:*:*", "matchCriteriaId": "6EC36F04-C3B1-4DBD-B28B-4C4BBBB139E0", "vulnerable": true}, {"criteria": "cpe:2.3:a:ibm:bigfix_platform:9.1.5:*:*:*:*:*:*:*", "matchCriteriaId": "B82EAE1E-3994-45CA-9988-7561A67652E6", "vulnerable": true}, {"criteria": "cpe:2.3:a:ibm:bigfix_platform:9.1.6:*:*:*:*:*:*:*", "matchCriteriaId": "200C85DF-E535-4A36-A601-9A6CF79141C0", "vulnerable": true}, {"criteria": "cpe:2.3:a:ibm:bigfix_platform:9.1.7:*:*:*:*:*:*:*", "matchCriteriaId": "D37ED6B1-BB21-4DC5-8DDD-909FEE674001", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Cross-site scripting (XSS) vulnerability in IBM BigFix Platform (formerly Tivoli Endpoint Manager) 9.x before 9.1.8 and 9.2.x before 9.2.8 allows remote attackers to inject arbitrary web script or HTML via a modified .beswrpt file."}, {"lang": "es", "value": "Vulnerabilidad de XSS en IBM BigFix Platform (anteriormente Tivoli Endpoint Manager) 9.x en versiones anteriores a 9.1.8 y 9.2.x en versiones anteriores a 9.2.8 permite a atacantes remotos inyectar secuencias de comandos web o HTML arbitrarios a trav\u00e9s de un archivo .beswrpt modificado."}], "id": "CVE-2016-0293", "lastModified": "2025-04-12T10:46:40.837", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 4.3, "confidentialityImpact": "NONE", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N", "version": "2.0"}, "exploitabilityScore": 8.6, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": true}], "cvssMetricV30": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.0"}, "exploitabilityScore": 2.8, "impactScore": 2.7, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2016-09-01T01:59:01.177", "references": [{"source": "psirt@us.ibm.com", "tags": ["Vendor Advisory"], "url": "http://www-01.ibm.com/support/docview.wss?uid=swg21985743"}, {"source": "psirt@us.ibm.com", "url": "http://www.securityfocus.com/bid/92593"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "http://www-01.ibm.com/support/docview.wss?uid=swg21985743"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.securityfocus.com/bid/92593"}], "sourceIdentifier": "psirt@us.ibm.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{

configurations : [ »

0 : { »

nodes : [ »

0 : { »

cpeMatch : [ »

0 : { »

criteria : cpe:2.3:a:ibm:bigfix_platform:9.2.0:*:*:*:*:*:*:* (string)

matchCriteriaId : 33D2F8B3-CCDD-4C4D-8790-4468A15D32AD (string)

vulnerable : true (boolean)

}

1 : { »

criteria : cpe:2.3:a:ibm:bigfix_platform:9.2.1:*:*:*:*:*:*:* (string)

matchCriteriaId : 3E47D31B-7665-416E-9220-7DC02B4BC298 (string)

vulnerable : true (boolean)

}

2 : { »

criteria : cpe:2.3:a:ibm:bigfix_platform:9.2.2:*:*:*:*:*:*:* (string)

matchCriteriaId : BF7890CF-0008-48BA-8A04-FCFFC0C1B01B (string)

vulnerable : true (boolean)

}

3 : { »

criteria : cpe:2.3:a:ibm:bigfix_platform:9.2.3:*:*:*:*:*:*:* (string)

matchCriteriaId : 4442C0AA-DE96-4040-B907-2B10167B18AC (string)

vulnerable : true (boolean)

}

4 : { »

criteria : cpe:2.3:a:ibm:bigfix_platform:9.2.4:*:*:*:*:*:*:* (string)

matchCriteriaId : AB5419C4-A2C6-417E-8EE4-A797579A2B1E (string)

vulnerable : true (boolean)

}

5 : { »

criteria : cpe:2.3:a:ibm:bigfix_platform:9.2.5:*:*:*:*:*:*:* (string)

matchCriteriaId : FF8C1B44-1283-441B-9AAB-B95C7DC80255 (string)

vulnerable : true (boolean)

}

6 : { »

criteria : cpe:2.3:a:ibm:bigfix_platform:9.2.6:*:*:*:*:*:*:* (string)

matchCriteriaId : 35FE1605-0746-4A94-A643-5187CBEAE596 (string)

vulnerable : true (boolean)

}

7 : { »

criteria : cpe:2.3:a:ibm:bigfix_platform:9.2.7:*:*:*:*:*:*:* (string)

matchCriteriaId : 5F6565DE-ACFA-41E7-8761-1C1BC8A301BF (string)

vulnerable : true (boolean)

}

]

negate : false (boolean)

operator : OR (string)

}

]

}

1 : { »

nodes : [ »

0 : { »

cpeMatch : [ »

0 : { »

criteria : cpe:2.3:a:ibm:bigfix_platform:9.0.5:*:*:*:*:*:*:* (string)

matchCriteriaId : DBF00DCA-80E9-4F8E-A0D6-9806206ECF58 (string)

vulnerable : true (boolean)

}

1 : { »

criteria : cpe:2.3:a:ibm:bigfix_platform:9.0.6:*:*:*:*:*:*:* (string)

matchCriteriaId : 3D9726F3-7DCE-4811-ADA3-CC517BD56123 (string)

vulnerable : true (boolean)

}

2 : { »

criteria : cpe:2.3:a:ibm:bigfix_platform:9.0.7:*:*:*:*:*:*:* (string)

matchCriteriaId : 8172EA9A-41B1-4FC3-9BF8-A6A2744AA8BE (string)

vulnerable : true (boolean)

}

3 : { »

criteria : cpe:2.3:a:ibm:bigfix_platform:9.0.8:*:*:*:*:*:*:* (string)

matchCriteriaId : 24A0AD9E-5753-48A5-B049-791564328E6D (string)

vulnerable : true (boolean)

}

]

negate : false (boolean)

operator : OR (string)

}

]

}

2 : { »

nodes : [ »

0 : { »

cpeMatch : [ »

0 : { »

criteria : cpe:2.3:a:ibm:bigfix_platform:9.1.3:*:*:*:*:*:*:* (string)

matchCriteriaId : 44A36BD8-D35C-4FDE-9CFC-455728F61F3F (string)

vulnerable : true (boolean)

}

1 : { »

criteria : cpe:2.3:a:ibm:bigfix_platform:9.1.4:*:*:*:*:*:*:* (string)

matchCriteriaId : 6EC36F04-C3B1-4DBD-B28B-4C4BBBB139E0 (string)

vulnerable : true (boolean)

}

2 : { »

criteria : cpe:2.3:a:ibm:bigfix_platform:9.1.5:*:*:*:*:*:*:* (string)

matchCriteriaId : B82EAE1E-3994-45CA-9988-7561A67652E6 (string)

vulnerable : true (boolean)

}

3 : { »

criteria : cpe:2.3:a:ibm:bigfix_platform:9.1.6:*:*:*:*:*:*:* (string)

matchCriteriaId : 200C85DF-E535-4A36-A601-9A6CF79141C0 (string)

vulnerable : true (boolean)

}

4 : { »

criteria : cpe:2.3:a:ibm:bigfix_platform:9.1.7:*:*:*:*:*:*:* (string)

matchCriteriaId : D37ED6B1-BB21-4DC5-8DDD-909FEE674001 (string)

vulnerable : true (boolean)

}

]

negate : false (boolean)

operator : OR (string)

}

]

}

]

cveTags : [ *empty* ]

descriptions : [ »

0 : { »

lang : en (string)

value : Cross-site scripting (XSS) vulnerability in IBM BigFix Platform (formerly Tivoli Endpoint Manager) 9.x before 9.1.8 and 9.2.x before 9.2.8 allows remote attackers to inject arbitrary web script or HTML via a modified .beswrpt file. (string)

}

1 : { »

lang : es (string)

value : Vulnerabilidad de XSS en IBM BigFix Platform (anteriormente Tivoli Endpoint Manager) 9.x en versiones anteriores a 9.1.8 y 9.2.x en versiones anteriores a 9.2.8 permite a atacantes remotos inyectar secuencias de comandos web o HTML arbitrarios a través de un archivo .beswrpt modificado. (string)

}

]

id : CVE-2016-0293 (string)

lastModified : 2025-04-12T10:46:40.837 (string)

metrics : { »

cvssMetricV2 : [ »

0 : { »

acInsufInfo : false (boolean)

baseSeverity : MEDIUM (string)

cvssData : { »

accessComplexity : MEDIUM (string)

accessVector : NETWORK (string)

authentication : NONE (string)

availabilityImpact : NONE (string)

baseScore : 4.3 (number)

confidentialityImpact : NONE (string)

integrityImpact : PARTIAL (string)

vectorString : AV:N/AC:M/Au:N/C:N/I:P/A:N (string)

version : 2.0 (string)

}

exploitabilityScore : 8.6 (number)

impactScore : 2.9 (number)

obtainAllPrivilege : false (boolean)

obtainOtherPrivilege : false (boolean)

obtainUserPrivilege : false (boolean)

source : nvd@nist.gov (string)

type : Primary (string)

userInteractionRequired : true (boolean)

}

]

cvssMetricV30 : [ »

0 : { »

cvssData : { »

attackComplexity : LOW (string)

attackVector : NETWORK (string)

availabilityImpact : NONE (string)

baseScore : 6.1 (number)

baseSeverity : MEDIUM (string)

confidentialityImpact : LOW (string)

integrityImpact : LOW (string)

privilegesRequired : NONE (string)

scope : CHANGED (string)

userInteraction : REQUIRED (string)

vectorString : CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N (string)

version : 3.0 (string)

}

exploitabilityScore : 2.8 (number)

impactScore : 2.7 (number)

source : nvd@nist.gov (string)

type : Primary (string)

}

]

}

published : 2016-09-01T01:59:01.177 (string)

references : [ »

0 : { »

source : psirt@us.ibm.com (string)

tags : [ »

0 : Vendor Advisory (string)

]

url : http://www-01.ibm.com/support/docview.wss?uid=swg21985743 (string)

}

1 : { »

source : psirt@us.ibm.com (string)

url : http://www.securityfocus.com/bid/92593 (string)

}

2 : { »

source : af854a3a-2127-422b-91ae-364da2661108 (string)

tags : [ »

0 : Vendor Advisory (string)

]

url : http://www-01.ibm.com/support/docview.wss?uid=swg21985743 (string)

}

3 : { »

source : af854a3a-2127-422b-91ae-364da2661108 (string)

url : http://www.securityfocus.com/bid/92593 (string)

}

]

sourceIdentifier : psirt@us.ibm.com (string)

vulnStatus : Deferred (string)

weaknesses : [ »

0 : { »

description : [ »

0 : { »

lang : en (string)

value : CWE-79 (string)

}

]

source : nvd@nist.gov (string)

type : Primary (string)

}

]

}

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Changed

Confidentiality Impact Low

Integrity Impact Low

Availability Impact None

User Interaction Required

Access Vector Network

Access Complexity Medium

Authentication None

Confidentiality Impact None

Integrity Impact Partial

Availability Impact None

Affected Vendors & Products

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Changed

Confidentiality Impact Low

Integrity Impact Low

Availability Impact None

User Interaction Required

Access Vector Network

Access Complexity Medium

Authentication None

Confidentiality Impact None

Integrity Impact Partial

Availability Impact None

Affected Vendors & Products

JSON object

JSON object

JSON object

JSON object