VYPR
Get started
← All advisories
Low severity3.7NVD Advisory· Published Feb 1, 2017· Updated May 13, 2026

CVE-2016-5953

CVE-2016-5953

Description

IBM Sterling Order Management transmits the session identifier within the URL. When a user is unable to view a certain view due to not being allowed permissions, the website responds with an error page where the session identifier is encoded as Base64 in the URL.

Affected products

7
  • IBM/Sterling Selling And Fulfillment Foundation6 versions
    cpe:2.3:a:ibm:sterling_selling_and_fulfillment_foundation:9.1.0:*:*:*:*:*:*:*+ 5 more
    • cpe:2.3:a:ibm:sterling_selling_and_fulfillment_foundation:9.1.0:*:*:*:*:*:*:*
    • cpe:2.3:a:ibm:sterling_selling_and_fulfillment_foundation:9.2.0:*:*:*:*:*:*:*
    • cpe:2.3:a:ibm:sterling_selling_and_fulfillment_foundation:9.2.1:*:*:*:*:*:*:*
    • cpe:2.3:a:ibm:sterling_selling_and_fulfillment_foundation:9.3:*:*:*:*:*:*:*
    • cpe:2.3:a:ibm:sterling_selling_and_fulfillment_foundation:9.4:*:*:*:*:*:*:*
    • cpe:2.3:a:ibm:sterling_selling_and_fulfillment_foundation:9.5:*:*:*:*:*:*:*
  • IBM Corporation/Sterling Order Managementv5
    Range: 8.5

Patches

0

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

2

News mentions

0

No linked articles in our index yet.