PatchSiren

PatchSiren cyber security CVE debrief

CVE-2016-5948 IBM CVE debrief

CVE-2016-5948 is a cross-site scripting issue in IBM Kenexa LCMS Premier on Cloud. According to NVD, the flaw can let a user embed arbitrary JavaScript in the web UI, which can alter intended application behavior and may lead to credential disclosure within a trusted session. NVD rates the issue CVSS 3.0 5.4 (Medium).

Vendor
IBM
Product
Kenexa Lcms Premier
CVSS
MEDIUM 5.4
CISA KEV
Not listed in stored evidence
Original CVE published
2017-02-01
Original CVE updated
2026-05-13
Advisory published
2017-02-01
Advisory updated
2026-05-13

Who should care

Administrators, security teams, and application owners running IBM Kenexa LCMS Premier versions 9.0 through 10.2 should review exposure. Any environment that allows users to submit or render web content in the product’s UI should treat this as a client-side injection risk.

Technical summary

NVD identifies the weakness as CWE-79 (Cross-Site Scripting). The affected product scope includes IBM Kenexa LCMS Premier versions 9.0, 9.1, 9.2, 9.2.1, 9.3, 9.4, 9.5, 10.0, 10.1, and 10.2. The recorded CVSS v3.0 vector is CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N, indicating network reachability, low attack complexity, required user interaction, and potential scope change with limited confidentiality and integrity impact.

Defensive priority

Medium

Recommended defensive actions

  • Confirm whether IBM Kenexa LCMS Premier is deployed and map the installed version against the affected versions listed by NVD.
  • Apply the IBM remediation referenced in the vendor advisory as soon as practical.
  • Review any UI fields, templates, or content rendering paths that accept user-controlled input and ensure HTML/JavaScript is properly sanitized or escaped.
  • Limit access to privileged content-editing features and use least-privilege roles for users who can create or modify web content.
  • Monitor for unexpected script injection indicators, unusual session behavior, or signs of credential exposure in affected workflows.
  • If exposure is suspected, invalidate active sessions and review authentication logs and recent content changes.

Evidence notes

This debrief is based on the supplied NVD record for CVE-2016-5948, which lists the affected IBM Kenexa LCMS Premier versions, the CVSS v3.0 vector, and CWE-79. The NVD reference list also points to an IBM PSIRT advisory/patch reference and a third-party advisory entry. No KEV listing was supplied.

Sources and references

Verified primary and authoritative sources

  • CVE-2016-5948 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2016-5948

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2016-5948 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2016-5948

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.