« Volver al listado

CVE-2016-5941

Estado: ModificadaMedia (5.7)—

IBM Kenexa LMS on Cloud could allow a remote attacker to traverse directories on the system. An attacker could send a specially-crafted URL request containing dot dot sequences (/../) to view arbitrary files on the system.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

IBM — Kenexa LMS

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2016-5941",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 3.5,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:M/Au:S/C:P/I:N/A:N",
          "authentication": "SINGLE",
          "integrityImpact": "NONE",
          "accessComplexity": "MEDIUM",
          "availabilityImpact": "NONE",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 2.9,
        "baseSeverity": "LOW",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 6.8,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": true
      }
    ],
    "cvssMetricV30": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.0",
          "baseScore": 5.7,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N",
          "integrityImpact": "NONE",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 2.1
      }
    ]
  },
  "affected": [
    {
      "source": "psirt@us.ibm.com",
      "affectedData": [
        {
          "vendor": "IBM Corporation",
          "product": "Kenexa LMS on Cloud",
          "versions": [
            {
              "status": "affected",
              "version": "13.0"
            },
            {
              "status": "affected",
              "version": "13.1"
            },
            {
              "status": "affected",
              "version": "13.2"
            },
            {
              "status": "affected",
              "version": "13.2.2"
            },
            {
              "status": "affected",
              "version": "13.2.3"
            },
            {
              "status": "affected",
              "version": "13.2.4"
            },
            {
              "status": "affected",
              "version": "14.0.0"
            },
            {
              "status": "affected",
              "version": "14.1.0"
            },
            {
              "status": "affected",
              "version": "14.2.0"
            }
          ]
        }
      ]
    }
  ],
  "published": "2017-02-01T22:59:00.510",
  "references": [
    {
      "url": "http://www.ibm.com/support/docview.wss?uid=swg21992072",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "source": "psirt@us.ibm.com"
    },
    {
      "url": "http://www.securityfocus.com/bid/95438",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "source": "psirt@us.ibm.com"
    },
    {
      "url": "http://www.ibm.com/support/docview.wss?uid=swg21992072",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.securityfocus.com/bid/95438",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-22"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "IBM Kenexa LMS on Cloud could allow a remote attacker to traverse directories on the system. An attacker could send a specially-crafted URL request containing dot dot sequences (/../) to view arbitrary files on the system."
    },
    {
      "lang": "es",
      "value": "IBM Kenexa LMS en Cloud podría permitir a un atacante remoto recorrer los directorios en el sistema. Un atacante podría enviar una petición de URL especialmente manipulada que contenga la secuencia \"punto punto\" (/../) para ver archivos arbitrarios en el sistema."
    }
  ],
  "lastModified": "2026-06-17T00:50:16.363",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:ibm:kenexa_lms:4.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "95E5FF84-CDE4-4945-9151-81191E39C57F"
            },
            {
              "criteria": "cpe:2.3:a:ibm:kenexa_lms:4.2:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "BB9B9931-8E60-4D98-8797-E669E4D5BFAE"
            },
            {
              "criteria": "cpe:2.3:a:ibm:kenexa_lms:4.2.2:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "9C2E4654-39DC-4DC8-A617-07A85D935912"
            },
            {
              "criteria": "cpe:2.3:a:ibm:kenexa_lms:4.2.3:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "A744F1DC-C419-4287-B3DA-0EEB2310B81B"
            },
            {
              "criteria": "cpe:2.3:a:ibm:kenexa_lms:4.2.4:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "17CC61B4-AF0C-4E60-8CD9-3644BC48E9A6"
            },
            {
              "criteria": "cpe:2.3:a:ibm:kenexa_lms:5.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "4B8D8758-F0B9-4FA4-BD04-33289E48EA22"
            },
            {
              "criteria": "cpe:2.3:a:ibm:kenexa_lms:5.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "D24C3838-9D3A-4426-AEB4-238AB868DBC8"
            },
            {
              "criteria": "cpe:2.3:a:ibm:kenexa_lms:5.2:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "5C076D38-466E-4D0D-B049-130EA55F71F4"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "psirt@us.ibm.com"
}