PatchSiren cyber security CVE debrief

CVE-2016-5938 IBM CVE debrief

CVE-2016-5938 is a low-severity information disclosure issue in IBM Kenexa LMS on Cloud. According to NVD, the flaw can allow web pages stored locally to be read by another user on the system. The CVE was published on 2017-02-01 and is not listed as a Known Exploited Vulnerability.

Vendor: IBM
Product: CVE-2016-5938
CVSS: LOW 3.3
CISA KEV: Not listed in stored evidence
Original CVE published: 2017-02-01
Original CVE updated: 2026-05-13
Advisory published: 2017-02-01
Advisory updated: 2026-05-13

Who should care

IBM Kenexa LMS on Cloud administrators, especially in shared or multi-user environments where local files or stored pages may be accessible to other accounts. Security teams responsible for routine patching and access control reviews should prioritize validation of exposure.

Technical summary

NVD identifies this issue as CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor) with CVSS v3.0 vector CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N. The vulnerable CPEs cover IBM Kenexa LMS versions 4.1, 4.2, 4.2.2, 4.2.3, 4.2.4, 5.0, 5.1, and 5.2. The disclosed impact is confidentiality-only and requires local access with low privileges.

Defensive priority

Low

Recommended defensive actions

Review IBM's vendor advisory and apply the referenced patch or mitigation for Kenexa LMS on Cloud.
Restrict local and account-level access on shared systems to reduce the chance that another user can read stored pages.
Audit where application-generated web pages or cached content are stored and ensure permissions prevent cross-user access.
Validate whether any affected IBM Kenexa LMS versions from 4.1 through 5.2 remain in use and schedule remediation during routine maintenance.

Evidence notes

Source corpus supports an information-disclosure finding: NVD lists CWE-200 and CVSS v3.0 AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N. The affected product versions in NVD are IBM Kenexa LMS 4.1 through 5.2. NVD references an IBM PSIRT advisory and a SecurityFocus entry; the IBM advisory is the primary vendor-linked mitigation source in the supplied corpus.

Official resources

CVE-2016-5938 CVE record
CVE.org
CVE-2016-5938 NVD detail
NVD
Source item URL
nvd_modified
Mitigation or vendor reference
[email protected] - Patch, Vendor Advisory
Mitigation or vendor reference
[email protected] - Third Party Advisory, VDB Entry

Publicly disclosed in NVD on 2017-02-01. The record was modified on 2026-05-13. No KEV listing is present in the supplied data.