PatchSiren

PatchSiren cyber security CVE debrief

CVE-2016-5897 IBM CVE debrief

CVE-2016-5897 is an HTML injection vulnerability in IBM Jazz Reporting Service (JRS). A remote attacker could inject malicious HTML that, when viewed by a victim, executes in the browser within the security context of the hosting site. IBM’s advisory-linked NVD entry identifies affected JRS versions 6.0, 6.0.1, and 6.0.2 and classifies the issue as CWE-79 with a medium CVSS score of 5.4.

Vendor
IBM
Product
Jazz Reporting Service
CVSS
MEDIUM 5.4
CISA KEV
Not listed in stored evidence
Original CVE published
2017-02-01
Original CVE updated
2026-05-13
Advisory published
2017-02-01
Advisory updated
2026-05-13

Who should care

Administrators and users of IBM Jazz Reporting Service deployments running versions 6.0, 6.0.1, or 6.0.2 should care, especially where report content is shared across users or viewed in a browser by higher-privileged staff.

Technical summary

The flaw is a browser-side content injection issue in JRS. An attacker able to supply crafted HTML can cause a victim’s browser to render attacker-controlled markup in the site context, which can lead to unauthorized content injection and limited confidentiality or integrity impact. The NVD vector (CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) shows network reachability, low attack complexity, low privileges, and required user interaction.

Defensive priority

Medium. This is not a high-availability risk, but it can affect user trust, session context, and the integrity of rendered reporting content.

Recommended defensive actions

  • Apply the IBM fix or mitigation referenced in the IBM PSIRT advisory for JRS.
  • Confirm whether any IBM Jazz Reporting Service instances run versions 6.0, 6.0.1, or 6.0.2 and prioritize them for remediation.
  • Review application input handling and output encoding controls around any user-supplied report content or parameters.
  • Validate that report pages and shared links do not render unsanitized HTML from untrusted sources.
  • Use the referenced IBM advisory and NVD record to confirm the exact remediation path for your deployment.

Evidence notes

The NVD record for CVE-2016-5897 states that IBM Jazz Reporting Service is vulnerable to HTML injection and lists vulnerable CPEs for IBM Jazz Reporting Service 6.0, 6.0.1, and 6.0.2. The CVSS 3.0 vector is AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N, and the weakness is mapped to CWE-79. The source references an IBM PSIRT advisory URL (swg21991153) and a SecurityFocus entry (BID 94857). PublishedAt is 2017-02-01T20:59:01.020Z; modifiedAt 2026-05-13T00:24:29.033Z are metadata timestamps, not separate issue dates.

Sources and references

Verified primary and authoritative sources

  • CVE-2016-5897 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2016-5897

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2016-5897 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2016-5897

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.