CVE-2016-2980 - Vulnerability Details - OpenCVE

The Sametime WebPlayer 8.5.2 and 9.0 is vulnerable to a script injection where a malicious site can inject their own script by exploiting a vulnerability in the way that the WebPlayer works. IBM X-Force ID: 113993.

No CVSS v4.0

No CVSS v3.1

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact Low

Integrity Impact Low

Availability Impact Low

User Interaction Required

Access Vector Network

Access Complexity Medium

Authentication None

Confidentiality Impact Partial

Integrity Impact Partial

Availability Impact Partial

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Ibm	Sametime

Configuration 1 [-]

OR	cpe:2.3:a:ibm:sametime:8.5.2.0:::::::*
	cpe:2.3:a:ibm:sametime:8.5.2.1:::::::*
	cpe:2.3:a:ibm:sametime:9.0.0.0:::::::*
	cpe:2.3:a:ibm:sametime:9.0.0.1:::::::*
	cpe:2.3:a:ibm:sametime:9.0.1:::::::*

No data.

References

Link	Providers
https://www.spirityenterprise.com/pentest
https://www.spirityenterprise.com/managed-detection-response
http://www.ibm.com/support/docview.wss?uid=swg22006447
http://www.securityfocus.com/bid/100531
https://exchange.xforce.ibmcloud.com/vulnerabilities/113993

History

No history.

MITRE

Status: PUBLISHED

Assigner: ibm

Published: 2017-08-29T21:00:00.000Z

Updated: 2024-09-17T02:46:58.231Z

Reserved: 2016-03-09T00:00:00.000Z

Link: CVE-2016-2980

Vulnrichment

No data.

NVD

Status : Modified

Published: 2017-08-29T21:29:00.497

Modified: 2026-05-13T00:24:29.033

Link: CVE-2016-2980

Redhat

No data.

{"containers": {"cna": {"affected": [{"product": "Sametime", "vendor": "IBM", "versions": [{"status": "affected", "version": "8.5.2"}, {"status": "affected", "version": "8.5.2.1"}, {"status": "affected", "version": "9.0"}, {"status": "affected", "version": "9.0.0.1"}, {"status": "affected", "version": "9.0.1"}]}], "datePublic": "2017-08-25T00:00:00.000Z", "descriptions": [{"lang": "en", "value": "The Sametime WebPlayer 8.5.2 and 9.0 is vulnerable to a script injection where a malicious site can inject their own script by exploiting a vulnerability in the way that the WebPlayer works. IBM X-Force ID: 113993."}], "problemTypes": [{"descriptions": [{"description": "Gain Access", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2017-08-31T09:57:01.000Z", "orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522", "shortName": "ibm"}, "references": [{"name": "100531", "tags": ["vdb-entry", "x_refsource_BID"], "url": "http://www.securityfocus.com/bid/100531"}, {"tags": ["x_refsource_MISC"], "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/113993"}, {"tags": ["x_refsource_CONFIRM"], "url": "http://www.ibm.com/support/docview.wss?uid=swg22006447"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "psirt@us.ibm.com", "DATE_PUBLIC": "2017-08-25T00:00:00", "ID": "CVE-2016-2980", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "Sametime", "version": {"version_data": [{"version_value": "8.5.2"}, {"version_value": "8.5.2.1"}, {"version_value": "9.0"}, {"version_value": "9.0.0.1"}, {"version_value": "9.0.1"}]}}]}, "vendor_name": "IBM"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "The Sametime WebPlayer 8.5.2 and 9.0 is vulnerable to a script injection where a malicious site can inject their own script by exploiting a vulnerability in the way that the WebPlayer works. IBM X-Force ID: 113993."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "Gain Access"}]}]}, "references": {"reference_data": [{"name": "100531", "refsource": "BID", "url": "http://www.securityfocus.com/bid/100531"}, {"name": "https://exchange.xforce.ibmcloud.com/vulnerabilities/113993", "refsource": "MISC", "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/113993"}, {"name": "http://www.ibm.com/support/docview.wss?uid=swg22006447", "refsource": "CONFIRM", "url": "http://www.ibm.com/support/docview.wss?uid=swg22006447"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-05T23:40:14.438Z"}, "title": "CVE Program Container", "references": [{"name": "100531", "tags": ["vdb-entry", "x_refsource_BID", "x_transferred"], "url": "http://www.securityfocus.com/bid/100531"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/113993"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "http://www.ibm.com/support/docview.wss?uid=swg22006447"}]}]}, "cveMetadata": {"assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522", "assignerShortName": "ibm", "cveId": "CVE-2016-2980", "datePublished": "2017-08-29T21:00:00.000Z", "dateReserved": "2016-03-09T00:00:00.000Z", "dateUpdated": "2024-09-17T02:46:58.231Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:ibm:sametime:8.5.2.0:*:*:*:*:*:*:*", "matchCriteriaId": "4D106630-D04F-406F-A3BD-029777B8E8F9", "vulnerable": true}, {"criteria": "cpe:2.3:a:ibm:sametime:8.5.2.1:*:*:*:*:*:*:*", "matchCriteriaId": "A84C4658-AEE7-4C63-A188-795B8FEB3A47", "vulnerable": true}, {"criteria": "cpe:2.3:a:ibm:sametime:9.0.0.0:*:*:*:*:*:*:*", "matchCriteriaId": "624F11B5-9305-49E9-A7F1-45845234BFD6", "vulnerable": true}, {"criteria": "cpe:2.3:a:ibm:sametime:9.0.0.1:*:*:*:*:*:*:*", "matchCriteriaId": "1E5B5DF0-0678-4E47-AC68-E24B5A93597D", "vulnerable": true}, {"criteria": "cpe:2.3:a:ibm:sametime:9.0.1:*:*:*:*:*:*:*", "matchCriteriaId": "F6F45A7B-1865-400A-A2E0-6E7BE46F6C8C", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The Sametime WebPlayer 8.5.2 and 9.0 is vulnerable to a script injection where a malicious site can inject their own script by exploiting a vulnerability in the way that the WebPlayer works. IBM X-Force ID: 113993."}, {"lang": "es", "value": "Sametime WebPlayer 8.5.2 y 9.0 es vulnerable a una inyecci\u00f3n de script por la cual un sitio malicioso puede inyectar sus propios scripts mediante la explotaci\u00f3n de una vulnerabilidad de la misma forma que funciona WebPlayer. IBM X-Force ID: 113993."}], "id": "CVE-2016-2980", "lastModified": "2026-05-13T00:24:29.033", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 6.8, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "version": "2.0"}, "exploitabilityScore": 8.6, "impactScore": 6.4, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": true}], "cvssMetricV30": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 6.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L", "version": "3.0"}, "exploitabilityScore": 2.8, "impactScore": 3.4, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2017-08-29T21:29:00.497", "references": [{"source": "psirt@us.ibm.com", "tags": ["Patch", "Vendor Advisory"], "url": "http://www.ibm.com/support/docview.wss?uid=swg22006447"}, {"source": "psirt@us.ibm.com", "tags": ["Third Party Advisory", "VDB Entry"], "url": "http://www.securityfocus.com/bid/100531"}, {"source": "psirt@us.ibm.com", "tags": ["VDB Entry", "Vendor Advisory"], "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/113993"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch", "Vendor Advisory"], "url": "http://www.ibm.com/support/docview.wss?uid=swg22006447"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory", "VDB Entry"], "url": "http://www.securityfocus.com/bid/100531"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["VDB Entry", "Vendor Advisory"], "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/113993"}], "sourceIdentifier": "psirt@us.ibm.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-74"}], "source": "nvd@nist.gov", "type": "Primary"}]}