SB2016102902 - Multiple vulnerabilities in IBM Financial Transaction Manager

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2016102902

SB2016102902 - Multiple vulnerabilities in IBM Financial Transaction Manager

Published: October 29, 2016 Updated: August 9, 2020

Security Bulletin ID SB2016102902
Severity
Medium
Patch available
NO
Number of vulnerabilities 2
Exploitation vector Remote access
Highest impact Data manipulation

Breakdown by Severity

Medium 50% Low 50%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 2 secuirty vulnerabilities.


1) Cross-site scripting (CVE-ID: CVE-2016-5920)

Vulnerability allows a remote attacker to perform Cross-site scripting attacks.

An input validation error exists in the Web UI in IBM Financial Transaction Manager (FTM) for ACH Services 3.0.0.x before fp0015 and 3.0.1.0 before iFix0002. A remote authenticated attacker can trick the victim to follow a specially crafted link and execute arbitrary HTML and script code in victim's browser in security context of vulnerable website.

Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.


2) Improper access control (CVE-ID: CVE-2016-3060)

The vulnerability allows a remote authenticated user to manipulate data.

Payments Director in IBM Financial Transaction Manager (FTM) for ACH Services, Check Services, and Corporate Payment Services (CPS) 3.0.0.x before fp0015 and 3.0.1.0 before iFix0002 allows remote authenticated users to conduct clickjacking attacks via a crafted web site.


Remediation

Cybersecurity Help is not aware of any official remediation provided by the vendor.

References