CVE-2016-2965

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

IBM Sametime Meeting Server 8.5.2 and 9.0 is vulnerable to cross-site request forgery, caused by improper validation of user-supplied input. By persuading a user to visit a malicious link, a remote attacker could force the user to log out of Sametime. IBM X-Force ID: 113846.

Metrics

CVSS 3.0 6.5/10CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-352

Affected software

Vendor	Product	Versions
IBM	Sametime	8.5.2; 8.5.2.1; 9.0; 9.0.0.1; 9.0.1

References

http://www.ibm.com/support/docview.wss?uid=swg22006439Patch, Vendor Advisory
http://www.securityfocus.com/bid/100599
http://www.securitytracker.com/id/1039231Third Party Advisory, VDB Entry
https://exchange.xforce.ibmcloud.com/vulnerabilities/113846VDB Entry, Vendor Advisory
http://www.ibm.com/support/docview.wss?uid=swg22006439Patch, Vendor Advisory
http://www.securityfocus.com/bid/100599
http://www.securitytracker.com/id/1039231Third Party Advisory, VDB Entry
https://exchange.xforce.ibmcloud.com/vulnerabilities/113846VDB Entry, Vendor Advisory

Timeline

Published: Aug 29, 2017
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2016

CVE-2016-29664.3IBM Sametime 8.5.1 and 9.0 could allow an authenticated user to enumerate meeting rooms by guessing the meeting room id. IBM X-Force ID: 113 CVE-2016-29675.4IBM Sametime 8.5.2 and 9.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the CVE-2016-29686.5IBM Security QRadar Incident Forensics 7.2.x before 7.2.7 allows remote attackers to bypass authentication, and obtain sensitive information CVE-2016-29694.3IBM Sametime Meeting Server 8.5.2 and 9.0 may send replies that contain emails of people that should not be in these messages. IBM X-Force I CVE-2016-29704.3IBM Sametime 8.5 and 9.0 meetings server may provide detailed information in an error message that may provide details about the application CVE-2016-29715.3IBM Sametime Media Services 8.5.2 and 9.0 can disclose sensitive information in stack trace error logs that could aid an attacker in future CVE-2016-29727.8IBM Sametime Meeting Server 8.5.2 and 9.0 could store credentials of the Sametime Meetings user in the local cache of their browser which co CVE-2016-29735.4IBM Sametime Media Services 8.5.2 and 9.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScri CVE-2016-29743.3IBM Sametime Connect 8.5.2 and 9.0, after uninstalling the Sametime Rich Client, could disclose potentially sensitive information related to CVE-2016-29755.4IBM Sametime 8.5.2 and 9.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the CVE-2016-29764.3IBM Sametime Meeting Server 8.5.2 and 9.0 could allow a meeting invitee to obtain previously cleared sensitive information by viewing the me CVE-2016-29774.3IBM Sametime Meeting Server 8.5.2 and 9.0 could allow a malicious user to lower other users hands in the meeting. IBM X-Force ID: 113937.