PatchSiren

PatchSiren cyber security CVE debrief

CVE-2016-5884 IBM CVE debrief

CVE-2016-5884 is a cross-site scripting issue in IBM iNotes that can let an attacker embed arbitrary JavaScript in the Web UI. Because the code runs in a trusted session, the impact can include credentials disclosure and other unauthorized actions in the context of the affected user. NVD publishes this CVE as modified on 2017-02-01 and updated again on 2026-05-13.

Vendor
IBM
Product
Domino
CVSS
MEDIUM 6.1
CISA KEV
Not listed in stored evidence
Original CVE published
2017-02-01
Original CVE updated
2026-05-13
Advisory published
2017-02-01
Advisory updated
2026-05-13

Who should care

IBM iNotes and IBM Domino administrators, especially teams running web-accessible mail or collaboration interfaces. Security teams should prioritize any deployment where users access the Web UI from untrusted networks or where browser sessions carry sensitive privileges.

Technical summary

NVD classifies the weakness as CWE-79 (cross-site scripting) with CVSS 3.0 vector CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N, which indicates network reachability, no privileges required, and user interaction. The NVD record lists affected IBM Domino and IBM iNotes versions across 8.5.1.0 through 9.0.1.6. The practical risk is that malicious script injected into the web interface can alter page behavior and act within the victim's authenticated session.

Defensive priority

Moderate. The combination of network exposure, no authentication requirement, and trusted-session impact makes this worth prompt remediation, especially for internet-facing deployments. The CVSS score is 6.1 (Medium).

Recommended defensive actions

  • Review IBM's vendor advisory and patch guidance linked from the NVD record and apply the recommended update for affected IBM iNotes/Domino releases.
  • Treat the issue as a web-session integrity risk: validate whether users can inject or persist untrusted content into the Web UI.
  • Prioritize remediation on externally reachable mail or collaboration portals and systems used by privileged users.
  • After patching, verify that browser-side protections and input handling in the affected Web UI are functioning as expected.
  • Monitor for suspicious session activity that could indicate script-based abuse of trusted user sessions.

Evidence notes

This debrief is based on the official NVD CVE record and linked vendor references. The NVD metadata identifies CWE-79 and CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N. The record lists vulnerable IBM Domino and IBM iNotes CPEs from 8.5.1.0 through 9.0.1.6, and references an IBM support advisory plus third-party advisories. The CVE was published in NVD on 2017-02-01 and later modified on 2026-05-13.

Sources and references

Verified primary and authoritative sources

  • CVE-2016-5884 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2016-5884

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2016-5884 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2016-5884

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.