Medium severity · published Jul 31, 2017
CVE-2016-9717
HTTP Parameter Override is identified in the IBM Infosphere Master Data Management (MDM) 10.1
6.5
CVSS
1.1%
EPSS
No
On KEV
Description
HTTP Parameter Override is identified in the IBM Infosphere Master Data Management (MDM) 10.1. 11.0. 11.3, 11.4, 11.5, and 11.6 product. It enables attackers by exposing the presence of duplicated parameters which may produce an anomalous behavior in the application that can be potentially exploited.
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
None
Integrity
High
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.1% · higher than 66% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
IM
Infosphere Master Data Management Server · Ibm
10.1; 11.0; 11.3; 11.4; 11.5; 11.6 · source: NVD
Affected product
IM
Infosphere Master Data Management Server
Ibm
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2016-9717
CVE.org
https://www.cve.org/CVERecord?id=CVE-2016-9717
Patch
http://www.ibm.com/support/docview.wss?uid=swg22006605
Third Party Advisory
http://www.securityfocus.com/bid/100074
VDB Entry
https://exchange.xforce.ibmcloud.com/vulnerabilities/119730
More from Infosphere Master Data Management Server
8.8
CVE-2016-9716
IBM InfoSphere Master Data Management Server 11.0, 11.3, 11.4, 11.5, and 11.6 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and…
8.8
CVE-2016-9714
IBM InfoSphere Master Data Management Server 10.1, 11.0, 11.3, 11.4, 11.5, and 11.6 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious…
7.8
CVE-2017-1309
IBM InfoSphere Master Data Management Server 11.0 - 11.6 stores user credentials in plain in clear text which can be read by a local user
6.5
CVE-2020-4675
IBM InfoSphere Master Data Management Server 11.6 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions…
5.7
CVE-2016-9719
IBM InfoSphere Master Data Management Server 10.1