CVE-2016-0377

4.3 mediumEPSS 1.5%

The Administrative Console in IBM WebSphere Application Server (WAS) 7.x before 7.0.0.43, 8.0.x before 8.0.0.13, and 8.5.x before 8.5.5.10 mishandles CSRFtoken cookies, which allows remote authenticated users to obtain sensitive information via unspecified vectors.

Severity

CVSS 3.0

4.3 medium

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

EPSS: 1.5% chance of exploitation in the next 30 days; higher than 74% of CVEs (scores of 2026-10-31)
CWE: CWE-200
Published: 2016-10-22
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

ibm:websphere_application_server

References

http://www-01.ibm.com/support/docview.wss?uid=swg1PI56917
http://www-01.ibm.com/support/docview.wss?uid=swg21980645
http://www.securityfocus.com/bid/92514
http://www.securitytracker.com/id/1036653
http://www-01.ibm.com/support/docview.wss?uid=swg1PI56917

Check your stack JSON