CVE-2016-9981 - Vulnerability Details

Vendors	Products
Ibm	Security Appscan

Link	Providers
http://www.ibm.com/support/docview.wss?uid=swg22006430
http://www.securitytracker.com/id/1039073
https://exchange.xforce.ibmcloud.com/vulnerabilities/120257

Show plain JSON

{"containers": {"cna": {"affected": [{"product": "Security AppScan Enterprise", "vendor": "IBM", "versions": [{"status": "affected", "version": "9.0"}, {"status": "affected", "version": "9.0.1"}, {"status": "affected", "version": "9.0.2"}, {"status": "affected", "version": "9.0.3"}]}], "datePublic": "2017-07-26T00:00:00", "descriptions": [{"lang": "en", "value": "IBM AppScan Enterprise Edition 9.0 contains an unspecified vulnerability that could allow an attacker to hijack a valid user's session. IBM X-Force ID: 120257"}], "problemTypes": [{"descriptions": [{"description": "Gain Access", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2017-08-05T09:57:01", "orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522", "shortName": "ibm"}, "references": [{"name": "1039073", "tags": ["vdb-entry", "x_refsource_SECTRACK"], "url": "http://www.securitytracker.com/id/1039073"}, {"tags": ["x_refsource_MISC"], "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/120257"}, {"tags": ["x_refsource_CONFIRM"], "url": "http://www.ibm.com/support/docview.wss?uid=swg22006430"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "psirt@us.ibm.com", "DATE_PUBLIC": "2017-07-26T00:00:00", "ID": "CVE-2016-9981", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "Security AppScan Enterprise", "version": {"version_data": [{"version_value": "9.0"}, {"version_value": "9.0.1"}, {"version_value": "9.0.2"}, {"version_value": "9.0.3"}]}}]}, "vendor_name": "IBM"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "IBM AppScan Enterprise Edition 9.0 contains an unspecified vulnerability that could allow an attacker to hijack a valid user's session. IBM X-Force ID: 120257"}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "Gain Access"}]}]}, "references": {"reference_data": [{"name": "1039073", "refsource": "SECTRACK", "url": "http://www.securitytracker.com/id/1039073"}, {"name": "https://exchange.xforce.ibmcloud.com/vulnerabilities/120257", "refsource": "MISC", "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/120257"}, {"name": "http://www.ibm.com/support/docview.wss?uid=swg22006430", "refsource": "CONFIRM", "url": "http://www.ibm.com/support/docview.wss?uid=swg22006430"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-06T03:07:31.790Z"}, "title": "CVE Program Container", "references": [{"name": "1039073", "tags": ["vdb-entry", "x_refsource_SECTRACK", "x_transferred"], "url": "http://www.securitytracker.com/id/1039073"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/120257"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "http://www.ibm.com/support/docview.wss?uid=swg22006430"}]}]}, "cveMetadata": {"assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522", "assignerShortName": "ibm", "cveId": "CVE-2016-9981", "datePublished": "2017-08-02T17:00:00Z", "dateReserved": "2016-12-16T00:00:00", "dateUpdated": "2024-09-17T00:20:31.510Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{

containers : { »

cna : { »

affected : [ »

0 : { »

product : Security AppScan Enterprise (string)

vendor : IBM (string)

versions : [ »

0 : { »

status : affected (string)

version : 9.0 (string)

}

1 : { »

status : affected (string)

version : 9.0.1 (string)

}

2 : { »

status : affected (string)

version : 9.0.2 (string)

}

3 : { »

status : affected (string)

version : 9.0.3 (string)

}

]

}

]

datePublic : 2017-07-26T00:00:00 (string)

descriptions : [ »

0 : { »

lang : en (string)

value : IBM AppScan Enterprise Edition 9.0 contains an unspecified vulnerability that could allow an attacker to hijack a valid user's session. IBM X-Force ID: 120257 (string)

}

]

problemTypes : [ »

0 : { »

descriptions : [ »

0 : { »

description : Gain Access (string)

lang : en (string)

type : text (string)

}

]

}

]

providerMetadata : { »

dateUpdated : 2017-08-05T09:57:01 (string)

orgId : 9a959283-ebb5-44b6-b705-dcc2bbced522 (string)

shortName : ibm (string)

}

references : [ »

0 : { »

name : 1039073 (string)

tags : [ »

0 : vdb-entry (string)

1 : x_refsource_SECTRACK (string)

]

url : http://www.securitytracker.com/id/1039073 (string)

}

1 : { »

tags : [ »

0 : x_refsource_MISC (string)

]

url : https://exchange.xforce.ibmcloud.com/vulnerabilities/120257 (string)

}

2 : { »

tags : [ »

0 : x_refsource_CONFIRM (string)

]

url : http://www.ibm.com/support/docview.wss?uid=swg22006430 (string)

}

]

x_legacyV4Record : { »

CVE_data_meta : { »

ASSIGNER : psirt@us.ibm.com (string)

DATE_PUBLIC : 2017-07-26T00:00:00 (string)

ID : CVE-2016-9981 (string)

STATE : PUBLIC (string)

}

affects : { »

vendor : { »

vendor_data : [ »

0 : { »

product : { »

product_data : [ »

0 : { »

product_name : Security AppScan Enterprise (string)

version : { »

version_data : [ »

0 : { »

version_value : 9.0 (string)

}

1 : { »

version_value : 9.0.1 (string)

}

2 : { »

version_value : 9.0.2 (string)

}

3 : { »

version_value : 9.0.3 (string)

}

]

}

]

}

vendor_name : IBM (string)

}

]

}

data_format : MITRE (string)

data_type : CVE (string)

data_version : 4.0 (string)

description : { »

description_data : [ »

0 : { »

lang : eng (string)

value : IBM AppScan Enterprise Edition 9.0 contains an unspecified vulnerability that could allow an attacker to hijack a valid user's session. IBM X-Force ID: 120257 (string)

}

]

}

problemtype : { »

problemtype_data : [ »

0 : { »

description : [ »

0 : { »

lang : eng (string)

value : Gain Access (string)

}

]

}

]

}

references : { »

reference_data : [ »

0 : { »

name : 1039073 (string)

refsource : SECTRACK (string)

url : http://www.securitytracker.com/id/1039073 (string)

}

1 : { »

name : https://exchange.xforce.ibmcloud.com/vulnerabilities/120257 (string)

refsource : MISC (string)

url : https://exchange.xforce.ibmcloud.com/vulnerabilities/120257 (string)

}

2 : { »

name : http://www.ibm.com/support/docview.wss?uid=swg22006430 (string)

refsource : CONFIRM (string)

url : http://www.ibm.com/support/docview.wss?uid=swg22006430 (string)

}

]

}

adp : [ »

0 : { »

providerMetadata : { »

orgId : af854a3a-2127-422b-91ae-364da2661108 (string)

shortName : CVE (string)

dateUpdated : 2024-08-06T03:07:31.790Z (string)

}

title : CVE Program Container (string)

references : [ »

0 : { »

name : 1039073 (string)

tags : [ »

0 : vdb-entry (string)

1 : x_refsource_SECTRACK (string)

2 : x_transferred (string)

]

url : http://www.securitytracker.com/id/1039073 (string)

}

1 : { »

tags : [ »

0 : x_refsource_MISC (string)

1 : x_transferred (string)

]

url : https://exchange.xforce.ibmcloud.com/vulnerabilities/120257 (string)

}

2 : { »

tags : [ »

0 : x_refsource_CONFIRM (string)

1 : x_transferred (string)

]

url : http://www.ibm.com/support/docview.wss?uid=swg22006430 (string)

}

]

}

]

}

cveMetadata : { »

assignerOrgId : 9a959283-ebb5-44b6-b705-dcc2bbced522 (string)

assignerShortName : ibm (string)

cveId : CVE-2016-9981 (string)

datePublished : 2017-08-02T17:00:00Z (string)

dateReserved : 2016-12-16T00:00:00 (string)

dateUpdated : 2024-09-17T00:20:31.510Z (string)

state : PUBLISHED (string)

}

dataType : CVE_RECORD (string)

dataVersion : 5.1 (string)

}

Show plain JSON

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:ibm:security_appscan:9.0.0.0:*:*:*:enterprise:*:*:*", "matchCriteriaId": "8D518ADB-942D-4DC9-A571-418926A0A916", "vulnerable": true}, {"criteria": "cpe:2.3:a:ibm:security_appscan:9.0.0.1:*:*:*:enterprise:*:*:*", "matchCriteriaId": "D4CDD602-C438-4432-B722-2B2FB36F05A7", "vulnerable": true}, {"criteria": "cpe:2.3:a:ibm:security_appscan:9.0.1.0:*:*:*:enterprise:*:*:*", "matchCriteriaId": "973B4DF6-B412-4F34-983B-4FD7DB609001", "vulnerable": true}, {"criteria": "cpe:2.3:a:ibm:security_appscan:9.0.1.1:*:*:*:enterprise:*:*:*", "matchCriteriaId": "EA9EA21C-F307-4149-9161-96B4A6486D08", "vulnerable": true}, {"criteria": "cpe:2.3:a:ibm:security_appscan:9.0.2.0:*:*:*:enterprise:*:*:*", "matchCriteriaId": "76990510-2312-4EB8-95C1-CA476FC16583", "vulnerable": true}, {"criteria": "cpe:2.3:a:ibm:security_appscan:9.0.2.1:*:*:*:enterprise:*:*:*", "matchCriteriaId": "CF93F878-04EF-4555-861C-F9307C1B0804", "vulnerable": true}, {"criteria": "cpe:2.3:a:ibm:security_appscan:9.0.3.0:*:*:*:enterprise:*:*:*", "matchCriteriaId": "AB1BC8E5-0AAA-4EF9-9C80-EFE67D726A1E", "vulnerable": true}, {"criteria": "cpe:2.3:a:ibm:security_appscan:9.0.3.1:*:*:*:enterprise:*:*:*", "matchCriteriaId": "3DFF7044-F37F-49BC-9BE5-AD602DC0B678", "vulnerable": true}, {"criteria": "cpe:2.3:a:ibm:security_appscan:9.0.3.4:*:*:*:enterprise:*:*:*", "matchCriteriaId": "1DB466FB-3B21-459C-A4B6-667304182ACC", "vulnerable": true}, {"criteria": "cpe:2.3:a:ibm:security_appscan:9.0.3.5:*:*:*:enterprise:*:*:*", "matchCriteriaId": "50E04810-CAD2-42A6-B151-3F58737EC66C", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "IBM AppScan Enterprise Edition 9.0 contains an unspecified vulnerability that could allow an attacker to hijack a valid user's session. IBM X-Force ID: 120257"}, {"lang": "es", "value": "IBM AppScan Enterprise Edition 9.0 incluye una vulnerabilidad no especificada que podr\u00eda permitir a un atacante secuestrar una sesi\u00f3n de usuario v\u00e1lida. IBM X-Force ID: 120257"}], "id": "CVE-2016-9981", "lastModified": "2025-04-20T01:37:25.860", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 6.8, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "version": "2.0"}, "exploitabilityScore": 8.6, "impactScore": 6.4, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV30": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.0"}, "exploitabilityScore": 2.2, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2017-08-02T17:29:00.187", "references": [{"source": "psirt@us.ibm.com", "tags": ["Patch", "Vendor Advisory"], "url": "http://www.ibm.com/support/docview.wss?uid=swg22006430"}, {"source": "psirt@us.ibm.com", "tags": ["Third Party Advisory", "VDB Entry"], "url": "http://www.securitytracker.com/id/1039073"}, {"source": "psirt@us.ibm.com", "tags": ["VDB Entry", "Vendor Advisory"], "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/120257"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch", "Vendor Advisory"], "url": "http://www.ibm.com/support/docview.wss?uid=swg22006430"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory", "VDB Entry"], "url": "http://www.securitytracker.com/id/1039073"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["VDB Entry", "Vendor Advisory"], "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/120257"}], "sourceIdentifier": "psirt@us.ibm.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-384"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{

configurations : [ »

0 : { »

nodes : [ »

0 : { »

cpeMatch : [ »

0 : { »

criteria : cpe:2.3:a:ibm:security_appscan:9.0.0.0:*:*:*:enterprise:*:*:* (string)

matchCriteriaId : 8D518ADB-942D-4DC9-A571-418926A0A916 (string)

vulnerable : true (boolean)

}

1 : { »

criteria : cpe:2.3:a:ibm:security_appscan:9.0.0.1:*:*:*:enterprise:*:*:* (string)

matchCriteriaId : D4CDD602-C438-4432-B722-2B2FB36F05A7 (string)

vulnerable : true (boolean)

}

2 : { »

criteria : cpe:2.3:a:ibm:security_appscan:9.0.1.0:*:*:*:enterprise:*:*:* (string)

matchCriteriaId : 973B4DF6-B412-4F34-983B-4FD7DB609001 (string)

vulnerable : true (boolean)

}

3 : { »

criteria : cpe:2.3:a:ibm:security_appscan:9.0.1.1:*:*:*:enterprise:*:*:* (string)

matchCriteriaId : EA9EA21C-F307-4149-9161-96B4A6486D08 (string)

vulnerable : true (boolean)

}

4 : { »

criteria : cpe:2.3:a:ibm:security_appscan:9.0.2.0:*:*:*:enterprise:*:*:* (string)

matchCriteriaId : 76990510-2312-4EB8-95C1-CA476FC16583 (string)

vulnerable : true (boolean)

}

5 : { »

criteria : cpe:2.3:a:ibm:security_appscan:9.0.2.1:*:*:*:enterprise:*:*:* (string)

matchCriteriaId : CF93F878-04EF-4555-861C-F9307C1B0804 (string)

vulnerable : true (boolean)

}

6 : { »

criteria : cpe:2.3:a:ibm:security_appscan:9.0.3.0:*:*:*:enterprise:*:*:* (string)

matchCriteriaId : AB1BC8E5-0AAA-4EF9-9C80-EFE67D726A1E (string)

vulnerable : true (boolean)

}

7 : { »

criteria : cpe:2.3:a:ibm:security_appscan:9.0.3.1:*:*:*:enterprise:*:*:* (string)

matchCriteriaId : 3DFF7044-F37F-49BC-9BE5-AD602DC0B678 (string)

vulnerable : true (boolean)

}

8 : { »

criteria : cpe:2.3:a:ibm:security_appscan:9.0.3.4:*:*:*:enterprise:*:*:* (string)

matchCriteriaId : 1DB466FB-3B21-459C-A4B6-667304182ACC (string)

vulnerable : true (boolean)

}

9 : { »

criteria : cpe:2.3:a:ibm:security_appscan:9.0.3.5:*:*:*:enterprise:*:*:* (string)

matchCriteriaId : 50E04810-CAD2-42A6-B151-3F58737EC66C (string)

vulnerable : true (boolean)

}

]

negate : false (boolean)

operator : OR (string)

}

]

}

]

cveTags : [ *empty* ]

descriptions : [ »

0 : { »

lang : en (string)

value : IBM AppScan Enterprise Edition 9.0 contains an unspecified vulnerability that could allow an attacker to hijack a valid user's session. IBM X-Force ID: 120257 (string)

}

1 : { »

lang : es (string)

value : IBM AppScan Enterprise Edition 9.0 incluye una vulnerabilidad no especificada que podría permitir a un atacante secuestrar una sesión de usuario válida. IBM X-Force ID: 120257 (string)

}

]

id : CVE-2016-9981 (string)

lastModified : 2025-04-20T01:37:25.860 (string)

metrics : { »

cvssMetricV2 : [ »

0 : { »

acInsufInfo : false (boolean)

baseSeverity : MEDIUM (string)

cvssData : { »

accessComplexity : MEDIUM (string)

accessVector : NETWORK (string)

authentication : NONE (string)

availabilityImpact : PARTIAL (string)

baseScore : 6.8 (number)

confidentialityImpact : PARTIAL (string)

integrityImpact : PARTIAL (string)

vectorString : AV:N/AC:M/Au:N/C:P/I:P/A:P (string)

version : 2.0 (string)

}

exploitabilityScore : 8.6 (number)

impactScore : 6.4 (number)

obtainAllPrivilege : false (boolean)

obtainOtherPrivilege : false (boolean)

obtainUserPrivilege : false (boolean)

source : nvd@nist.gov (string)

type : Primary (string)

userInteractionRequired : false (boolean)

}

]

cvssMetricV30 : [ »

0 : { »

cvssData : { »

attackComplexity : HIGH (string)

attackVector : NETWORK (string)

availabilityImpact : HIGH (string)

baseScore : 8.1 (number)

baseSeverity : HIGH (string)

confidentialityImpact : HIGH (string)

integrityImpact : HIGH (string)

privilegesRequired : NONE (string)

scope : UNCHANGED (string)

userInteraction : NONE (string)

vectorString : CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H (string)

version : 3.0 (string)

}

exploitabilityScore : 2.2 (number)

impactScore : 5.9 (number)

source : nvd@nist.gov (string)

type : Primary (string)

}

]

}

published : 2017-08-02T17:29:00.187 (string)

references : [ »

0 : { »

source : psirt@us.ibm.com (string)

tags : [ »

0 : Patch (string)

1 : Vendor Advisory (string)

]

url : http://www.ibm.com/support/docview.wss?uid=swg22006430 (string)

}

1 : { »

source : psirt@us.ibm.com (string)

tags : [ »

0 : Third Party Advisory (string)

1 : VDB Entry (string)

]

url : http://www.securitytracker.com/id/1039073 (string)

}

2 : { »

source : psirt@us.ibm.com (string)

tags : [ »

0 : VDB Entry (string)

1 : Vendor Advisory (string)

]

url : https://exchange.xforce.ibmcloud.com/vulnerabilities/120257 (string)

}

3 : { »

source : af854a3a-2127-422b-91ae-364da2661108 (string)

tags : [ »

0 : Patch (string)

1 : Vendor Advisory (string)

]

url : http://www.ibm.com/support/docview.wss?uid=swg22006430 (string)

}

4 : { »

source : af854a3a-2127-422b-91ae-364da2661108 (string)

tags : [ »

0 : Third Party Advisory (string)

1 : VDB Entry (string)

]

url : http://www.securitytracker.com/id/1039073 (string)

}

5 : { »

source : af854a3a-2127-422b-91ae-364da2661108 (string)

tags : [ »

0 : VDB Entry (string)

1 : Vendor Advisory (string)

]

url : https://exchange.xforce.ibmcloud.com/vulnerabilities/120257 (string)

}

]

sourceIdentifier : psirt@us.ibm.com (string)

vulnStatus : Deferred (string)

weaknesses : [ »

0 : { »

description : [ »

0 : { »

lang : en (string)

value : CWE-384 (string)

}

]

source : nvd@nist.gov (string)

type : Primary (string)

}

]

}

Metrics

Attack Vector Network

Attack Complexity High

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

Access Vector Network

Access Complexity Medium

Authentication None

Confidentiality Impact Partial

Integrity Impact Partial

Availability Impact Partial

Affected Vendors & Products

Metrics

Attack Vector Network

Attack Complexity High

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

Access Vector Network

Access Complexity Medium

Authentication None

Confidentiality Impact Partial

Integrity Impact Partial

Availability Impact Partial

Affected Vendors & Products

JSON object

JSON object

JSON object

JSON object