IBM Jazz Reporting Service up to 5.0.2 iFix015/6.0.1 iFix004 Report Builder/Data Collection clickjacking

Summaryinfo

A vulnerability marked as problematic has been reported in IBM Jazz Reporting Service up to 5.0.2 iFix015/6.0.1 iFix004. Affected is an unknown function of the component Report Builder/Data Collection Component. This manipulation causes clickjacking. This vulnerability appears as CVE-2016-0314. The attack may be initiated remotely. There is no available exploit. Applying a patch is the recommended action to fix this issue.

Detailsinfo

A vulnerability classified as critical was found in IBM Jazz Reporting Service up to 5.0.2 iFix015/6.0.1 iFix004 (Reporting Software). Affected by this vulnerability is an unknown code of the component Report Builder/Data Collection Component. The manipulation with an unknown input leads to a clickjacking vulnerability. The CWE definition for the vulnerability is CWE-451. The user interface (UI) does not properly represent critical information to the user, allowing the information - or its source - to be obscured or spoofed. This is often a component in phishing attacks. As an impact it is known to affect confidentiality, integrity, and availability. The summary by CVE is:

The Report Builder and Data Collection Component (DCC) in IBM Jazz Reporting Service (JRS) 5.x before 5.0.2 ifix016 and 6.x before 6.0.1 ifix005 allow remote authenticated users to conduct clickjacking attacks via unspecified vectors.

The weakness was presented 07/08/2016 (Website). The advisory is shared at www-01.ibm.com. This vulnerability is known as CVE-2016-0314 since 12/08/2015. The exploitation appears to be easy. The attack can be launched remotely. A single authentication is needed for exploitation. Neither technical details nor an exploit are publicly available. MITRE ATT&CK project uses the attack technique T1566.003 for this issue.

Applying the patch 5.0.2 iFix016/6.0.1 iFix005 is able to eliminate this problem.

The vulnerability is also documented in the vulnerability database at SecurityFocus (BID 91697†). See VDB-88812, VDB-88814, VDB-88815 and VDB-88821 for similar entries. If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Type

• Reporting Software

Vendor

• IBM

Name

• Jazz Reporting Service

Version

• 5.0.2 iFix015
• 6.0.1 iFix004

License

• commercial

Website

• Vendor: https://www.ibm.com/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion