PatchSiren

PatchSiren cyber security CVE debrief

CVE-2016-2939 IBM CVE debrief

CVE-2016-2939 is a cross-site scripting vulnerability in IBM iNotes, also reflected in IBM Domino CPE coverage in NVD. The issue was published on 2017-02-01 and is rated medium severity (CVSS 6.1). Because the flaw allows JavaScript to run inside the Web UI, an attacker can alter page behavior and potentially expose credentials within a trusted session.

Vendor
IBM
Product
CVE-2016-2939
CVSS
MEDIUM 6.1
CISA KEV
Not listed in stored evidence
Original CVE published
2017-02-01
Original CVE updated
2026-05-13
Advisory published
2017-02-01
Advisory updated
2026-05-13

Who should care

IBM Domino and IBM iNotes administrators, security teams responsible for enterprise email/collaboration systems, and users who access the Web UI in authenticated sessions.

Technical summary

NVD maps this issue to CWE-79 (cross-site scripting) with a CVSS v3.0 vector of AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N. The vulnerable surface is the IBM iNotes Web UI, where arbitrary JavaScript can be embedded and executed. NVD also lists IBM Domino and IBM iNotes versions from 8.5.1.0 through 9.0.1.6 as affected in the published CPE criteria. The impact described by the record is alteration of intended functionality and possible credential disclosure inside a trusted session.

Defensive priority

Medium. The vulnerability requires user interaction, but it affects a trusted web interface and can impact confidentiality and integrity within active sessions.

Recommended defensive actions

  • Review IBM's advisory and apply the vendor patch or update referenced by the IBM support notice.
  • Inventory IBM Domino and IBM iNotes deployments and compare them against the affected versions listed in NVD.
  • Treat untrusted input in the Web UI as potentially script-capable until the fix is confirmed in your environment.
  • Prioritize remediation for externally reachable web access and any environment where users routinely handle sensitive mail or collaboration data.
  • After patching, validate that the affected Web UI no longer accepts script injection in normal workflows.

Evidence notes

All statements are taken from the supplied NVD record and its vendor references. The description cites arbitrary JavaScript in the Web UI and potential credential disclosure in a trusted session. The weakness is listed as CWE-79, and the CVSS vector is CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N. IBM's advisory URL is included in the source corpus as the patch/vendor reference.

Official resources

Publicly disclosed in the official record on 2017-02-01; the NVD entry was last modified on 2026-05-13.