CVE-2016-9975

High

Published: 24/02/2017(UTC)Translated: 15/06/2026(UTC)NVD NIST

Summary

IBM Jazz for Service Management versions 1.1.2.1 and 1.1.3 are vulnerable to cross-site request forgery, which could allow an attacker to execute malicious and unauthorized actions on behalf of a trusted user.

Risk Assessment

An attacker could exploit this vulnerability to perform unauthorized operations, potentially leading to serious security implications for the organization's data and systems.

Recommendation

It is recommended to update to the latest version of the software and implement protections against CSRF attacks.

Other vulnerabilities in IBM Jazz for Service Management

CVE-2025-36249Low
IBM Jazz for Service Management 1.1.3.0 through 1.1.3.25 does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie values by sending a http:// link to a user or by planting this link in a site the user goes to. The cookie will be sent to the insecure link and the attacker can then obtain the cookie value by snooping the traffic.

Original NVD description (English source)

IBM Jazz for Service Management 1.1.2.1 and 1.1.3 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. IBM Reference #: 1998714.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS