CVE-2016-2884

Severity: high (CVSS 8.0 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.5% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2016-11-30 · updated 2026-06-17
Weakness: CWE-352

Description

Cross-site request forgery (CSRF) vulnerability in IBM Forms Experience Builder 8.5.x and 8.6.x before 8.6.3.1, in an unspecified non-default configuration, allows remote authenticated users to hijack the authentication of arbitrary users for requests that insert XSS sequences.

Affected products

IBM Corporation Forms Experience Builder: 8.5.0.0, 8.5.1.0, 8.5.1.1, 8.6.0.0, 8.6.1, 8.6.1.1 (+3)

References

http://www-01.ibm.com/support/docview.wss?uid=swg1LO89686
http://www-01.ibm.com/support/docview.wss?uid=swg21987252
http://www-01.ibm.com/support/docview.wss?uid=swg1LO89686
http://www-01.ibm.com/support/docview.wss?uid=swg21987252

Get alerted when CVE-2016-2884 or the next vulnerability affects your stack