IBM Sametime Web Player CVE-2016-2980 Arbitrary Script Injection Vulnerability

Bugtraq ID:	100531
Class:	Input Validation Error
CVE:	CVE-2016-2980
Remote:	Yes
Local:	No
Published:	Aug 25 2017 12:00AM
Updated:	Aug 25 2017 12:00AM
Credit:	IBM
Vulnerable:	IBM Sametime 9.0.1 IBM Sametime 9.0.0.1 IBM Sametime 9.0.0.0 IBM Sametime 8.5.2.1 IBM Sametime 8.5.2.0
Not Vulnerable:	IBM Sametime 9.0.1 FP1

IBM Sametime Web Player CVE-2016-2980 Arbitrary Script Injection Vulnerability

IBM Sametime Web Player is prone to an arbitrary script-injection vulnerability because it fails to properly sanitize user-supplied input.

An attacker can exploit this issue to execute arbitrary script code within the context of the affected application.

IBM Sametime 8.5.2, 8.5.2.1, 9.0, 9.0.0.1 and 9.0.1 are vulnerable.

IBM Sametime Web Player CVE-2016-2980 Arbitrary Script Injection Vulnerability

To launch an attack, an attacker must entice a victim into viewing a malicious website.

IBM Sametime Web Player CVE-2016-2980 Arbitrary Script Injection Vulnerability

Solution:
Updates are available. Please see the references or vendor advisory for more information.

IBM Sametime Web Player CVE-2016-2980 Arbitrary Script Injection Vulnerability

References:

• IBM Homepage (IBM)
  
• IBM Sametime Homepage (IBM)
  
• swg22006447: A vulnerability in IBM Sametime Web Player (CVE-2016-2980) (IBM)