Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
8.8
CVE-2016-0295: BigFix Platform lets attackers hijack user sessions
CVE-2016-0295 · published 8 years ago
Summary
The IBM BigFix Platform versions 9.0, 9.1, 9.2 and 9.5 (before 9.5.2) can be tricked into accepting forged requests, letting an attacker take over a logged‑in user's session and run malicious code. This could let an attacker perform actions as that user, including adding harmful scripts. Apply the latest IBM patch or upgrade to version 9.5.2 or later to close the gap.
What to do
- Update ibm bigfix_platform to version 9.5.2 or later.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| ibm | bigfix_platform |
>= 9.5, < 9.5.2 9.0 9.1 9.2 cpe:2.3:a:ibm:bigfix_platform:*:*:*:*:*:*:*:* |
Original advisory text
Cross-site request forgery (CSRF) vulnerability in the IBM BigFix Platform 9.0, 9.1, 9.2, and 9.5 before 9.5.2 allows remote attackers to hijack the authentication of arbitrary users for requests t...
Cross-site request forgery (CSRF) vulnerability in the IBM BigFix Platform 9.0, 9.1, 9.2, and 9.5 before 9.5.2 allows remote attackers to hijack the authentication of arbitrary users for requests that insert XSS sequences. IBM X-Force ID: 111363.
References
- http://www-01.ibm.com/support/docview.wss?uid=swg21985830 Mitigation Vendor Advisory
- https://exchange.xforce.ibmcloud.com/vulnerabilities/111363 VDB Entry Vendor Advisory
Internet-facing
14 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit (estimated)
- Gives an attacker full control (estimated)
Type
CWE-352Cross-Site Request Forgery (CSRF)
Timeline
Published28 Feb 2018
Updated31 Oct 2026
First seen29 Sep 2026
Sources
CVE-2016-0295 · NVD
Track software like this
Free during beta