CVE-2016-8961 - IBM BigFix Inventory v9 could allow a remote attacker to conduct phishing attacks, using an open red

CVE-2016-8961

Summary

IBM BigFix Inventory v9 could allow a remote attacker to conduct phishing attacks, using an open redirect attack. By persuading a victim to visit a specially-crafted Web site, a remote attacker could exploit this vulnerability to spoof the URL displayed to redirect a user to a malicious Web site that would appear to be trusted. This could allow the attacker to obtain highly sensitive information or conduct further attacks against the victim.

References

Vulnerable Configurations

cpe:2.3:a:ibm:license_metric_tool:9.2.0:*:*:*:*:*:*:*
cpe:2.3:a:ibm:license_metric_tool:9.2.0:*:*:*:*:*:*:*
cpe:2.3:o:hp:hp-ux:*:*:*:*:*:*:*:*
cpe:2.3:o:hp:hp-ux:*:*:*:*:*:*:*:*
cpe:2.3:o:ibm:aix:*:*:*:*:*:*:*:*
cpe:2.3:o:ibm:aix:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows:*:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows:*:*:*:*:*:*:*:*
cpe:2.3:o:oracle:solaris:*:*:*:*:*:*:*:*
cpe:2.3:o:oracle:solaris:*:*:*:*:*:*:*:*
cpe:2.3:a:ibm:bigfix_inventory:9.0:*:*:*:*:*:*:*
cpe:2.3:a:ibm:bigfix_inventory:9.0:*:*:*:*:*:*:*
cpe:2.3:a:ibm:bigfix_inventory:9.2:*:*:*:*:*:*:*
cpe:2.3:a:ibm:bigfix_inventory:9.2:*:*:*:*:*:*:*

CVSS

Base:	5.8 (as of 13-02-2017 - 22:39)
Impact:
Exploitability:

CWE

CWE-601

CAPEC

Access

Vector	Complexity	Authentication
NETWORK	MEDIUM	NONE

Impact

Confidentiality	Integrity	Availability
PARTIAL	PARTIAL	NONE

cvss-vector via4

AV:N/AC:M/Au:N/C:P/I:P/A:N

refmap via4

bid	95128
confirm	http://www.ibm.com/support/docview.wss?uid=swg21995037

Last major update

13-02-2017 - 22:39

Published

01-02-2017 - 20:59

Last modified

13-02-2017 - 22:39