« Volver al listado

CVE-2016-8931

Estado: ModificadaAlta (8.8)—

IBM Kenexa LMS on Cloud could allow a remote attacker to upload arbitrary files, which could allow the attacker to execute arbitrary code on the vulnerable server.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

IBM — Kenexa LMS

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2016-8931",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 6.5,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P",
          "authentication": "SINGLE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "LOW",
          "availabilityImpact": "PARTIAL",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 6.4,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 8,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV30": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.0",
          "baseScore": 8.8,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "psirt@us.ibm.com",
      "affectedData": [
        {
          "vendor": "IBM Corporation",
          "product": "Kenexa LMS on Cloud",
          "versions": [
            {
              "status": "affected",
              "version": "13.0"
            },
            {
              "status": "affected",
              "version": "13.1"
            },
            {
              "status": "affected",
              "version": "13.2"
            },
            {
              "status": "affected",
              "version": "13.2.2"
            },
            {
              "status": "affected",
              "version": "13.2.3"
            },
            {
              "status": "affected",
              "version": "13.2.4"
            },
            {
              "status": "affected",
              "version": "14.0.0"
            },
            {
              "status": "affected",
              "version": "14.1.0"
            },
            {
              "status": "affected",
              "version": "14.2.0"
            }
          ]
        }
      ]
    }
  ],
  "published": "2017-02-01T22:59:00.883",
  "references": [
    {
      "url": "http://www.ibm.com/support/docview.wss?uid=swg21992072",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "source": "psirt@us.ibm.com"
    },
    {
      "url": "http://www.securityfocus.com/bid/95451",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "source": "psirt@us.ibm.com"
    },
    {
      "url": "http://www.ibm.com/support/docview.wss?uid=swg21992072",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.securityfocus.com/bid/95451",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-284"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "IBM Kenexa LMS on Cloud could allow a remote attacker to upload arbitrary files, which could allow the attacker to execute arbitrary code on the vulnerable server."
    },
    {
      "lang": "es",
      "value": "IBM Kenexa LMS en Cloud podría permitir a un atacante remoto cargar archivos arbitrarios, lo que podría permitir al atacante ejecutar código arbitrario en el servidor vulnerable."
    }
  ],
  "lastModified": "2026-06-17T00:55:12.100",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:ibm:kenexa_lms:4.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "95E5FF84-CDE4-4945-9151-81191E39C57F"
            },
            {
              "criteria": "cpe:2.3:a:ibm:kenexa_lms:4.2:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "BB9B9931-8E60-4D98-8797-E669E4D5BFAE"
            },
            {
              "criteria": "cpe:2.3:a:ibm:kenexa_lms:4.2.2:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "9C2E4654-39DC-4DC8-A617-07A85D935912"
            },
            {
              "criteria": "cpe:2.3:a:ibm:kenexa_lms:4.2.3:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "A744F1DC-C419-4287-B3DA-0EEB2310B81B"
            },
            {
              "criteria": "cpe:2.3:a:ibm:kenexa_lms:4.2.4:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "17CC61B4-AF0C-4E60-8CD9-3644BC48E9A6"
            },
            {
              "criteria": "cpe:2.3:a:ibm:kenexa_lms:5.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "4B8D8758-F0B9-4FA4-BD04-33289E48EA22"
            },
            {
              "criteria": "cpe:2.3:a:ibm:kenexa_lms:5.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "D24C3838-9D3A-4426-AEB4-238AB868DBC8"
            },
            {
              "criteria": "cpe:2.3:a:ibm:kenexa_lms:5.2:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "5C076D38-466E-4D0D-B049-130EA55F71F4"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "psirt@us.ibm.com"
}