VYPR
← All advisories
High severity8.0NVD Advisory· Published Jul 3, 2016· Updated Jun 17, 2026

CVE-2016-2863

CVE-2016-2863

Description

Cross-site request forgery (CSRF) vulnerability in IBM WebSphere Commerce 7.0 Feature Pack 8, 8.0.0.x before 8.0.0.10, and 8.0.1.x before 8.0.1.2 allows remote authenticated users to hijack the authentication of arbitrary users for requests that insert XSS sequences.

Affected products

11
  • IBM/Websphere Commerce11 versions
    cpe:2.3:a:ibm:websphere_commerce:7.0:feature_pack_8:*:*:*:*:*:*+ 10 more
    • cpe:2.3:a:ibm:websphere_commerce:7.0:feature_pack_8:*:*:*:*:*:*
    • cpe:2.3:a:ibm:websphere_commerce:8.0.0.0:*:*:*:*:*:*:*
    • cpe:2.3:a:ibm:websphere_commerce:8.0.0.1:*:*:*:*:*:*:*
    • cpe:2.3:a:ibm:websphere_commerce:8.0.0.2:*:*:*:*:*:*:*
    • cpe:2.3:a:ibm:websphere_commerce:8.0.0.3:*:*:*:*:*:*:*
    • cpe:2.3:a:ibm:websphere_commerce:8.0.0.5:*:*:*:*:*:*:*
    • cpe:2.3:a:ibm:websphere_commerce:8.0.0.6:*:*:*:*:*:*:*
    • cpe:2.3:a:ibm:websphere_commerce:8.0.0.7:*:*:*:*:*:*:*
    • cpe:2.3:a:ibm:websphere_commerce:8.0.0.8:*:*:*:*:*:*:*
    • cpe:2.3:a:ibm:websphere_commerce:8.0.0.9:*:*:*:*:*:*:*
    • (no CPE)range: <= 7.0 Feature Pack 8, < 8.0.0.10, < 8.0.1.2

Patches

Vulnerability mechanics

References

4

News mentions

0

No linked articles in our index yet.