« Back to list

CVE-2016-5953

Status: ModifiedLow (3.7)—

IBM Sterling Order Management transmits the session identifier within the URL. When a user is unable to view a certain view due to not being allowed permissions, the website responds with an error page where the session identifier is encoded as Base64 in the URL.

CVSS

Exploitation probability (EPSS)

EPSS (Exploit Prediction Scoring System, FIRST) estimates how likely a vulnerability is to be exploited in the wild within 30 days. It complements CVSS (impact) and CISA KEV (confirmed exploitation).

Affected technologies (1)

IBM — Sterling Selling AND Fulfillment Foundation

CWEs

References

Raw JSON (NVD)

Show
{
  "id": "CVE-2016-5953",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 4.3,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:M/Au:N/C:P/I:N/A:N",
          "authentication": "NONE",
          "integrityImpact": "NONE",
          "accessComplexity": "MEDIUM",
          "availabilityImpact": "NONE",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 2.9,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 8.6,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV30": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.0",
          "baseScore": 3.7,
          "attackVector": "NETWORK",
          "baseSeverity": "LOW",
          "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "HIGH",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 1.4,
        "exploitabilityScore": 2.2
      }
    ]
  },
  "affected": [
    {
      "source": "psirt@us.ibm.com",
      "affectedData": [
        {
          "vendor": "IBM Corporation",
          "product": "Sterling Order Management",
          "versions": [
            {
              "status": "affected",
              "version": "8.5"
            },
            {
              "status": "affected",
              "version": "8.0"
            },
            {
              "status": "affected",
              "version": "9.1"
            },
            {
              "status": "affected",
              "version": "9.2"
            },
            {
              "status": "affected",
              "version": "9.2.1"
            },
            {
              "status": "affected",
              "version": "9.3"
            },
            {
              "status": "affected",
              "version": "9.4"
            },
            {
              "status": "affected",
              "version": "9.5"
            }
          ]
        }
      ]
    }
  ],
  "published": "2017-02-01T22:59:00.573",
  "references": [
    {
      "url": "http://www.ibm.com/support/docview.wss?uid=swg21994521",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "source": "psirt@us.ibm.com"
    },
    {
      "url": "http://www.securityfocus.com/bid/95431",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "source": "psirt@us.ibm.com"
    },
    {
      "url": "http://www.ibm.com/support/docview.wss?uid=swg21994521",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.securityfocus.com/bid/95431",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-200"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "IBM Sterling Order Management transmits the session identifier within the URL. When a user is unable to view a certain view due to not being allowed permissions, the website responds with an error page where the session identifier is encoded as Base64 in the URL."
    },
    {
      "lang": "es",
      "value": "IBM Sterling Order Management transmite el identificador de sesión dentro de la URL. Cuando un usuario no puede ver una determinada vista debido a que no se autorizan permisos, el sitio web responde con una página de error en la que el identificador de sesión se codifica como Base64 en la dirección URL."
    }
  ],
  "lastModified": "2026-06-17T00:50:17.683",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:ibm:sterling_selling_and_fulfillment_foundation:9.1.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "843E8EC3-1965-48FE-8FB9-A6A08BDD4C67"
            },
            {
              "criteria": "cpe:2.3:a:ibm:sterling_selling_and_fulfillment_foundation:9.2.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "5F5029B7-9CE0-44B2-A12D-6D51A04B1C4A"
            },
            {
              "criteria": "cpe:2.3:a:ibm:sterling_selling_and_fulfillment_foundation:9.2.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "01C65391-6BEB-437B-ADE2-A55D96309384"
            },
            {
              "criteria": "cpe:2.3:a:ibm:sterling_selling_and_fulfillment_foundation:9.3:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "10A09606-CB52-4494-A9E5-D983DEBD54C1"
            },
            {
              "criteria": "cpe:2.3:a:ibm:sterling_selling_and_fulfillment_foundation:9.4:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "C1CCE857-1D23-4F0E-AC7C-FD7B45913846"
            },
            {
              "criteria": "cpe:2.3:a:ibm:sterling_selling_and_fulfillment_foundation:9.5:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "443A72B2-E1F9-4069-8763-70F26498A058"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "psirt@us.ibm.com"
}