PatchSiren

PatchSiren cyber security CVE debrief

CVE-2016-8933 IBM CVE debrief

CVE-2016-8933 is a directory traversal issue in IBM Kenexa LMS on Cloud. According to the NVD record, a remote attacker could send a specially crafted URL containing dot-dot sequences ("/../") to view arbitrary files on the system. The issue was publicly disclosed in the NVD record on 2017-02-01 and later modified on 2026-05-13.

Vendor
IBM
Product
Kenexa Lms
CVSS
MEDIUM 6.5
CISA KEV
Not listed in stored evidence
Original CVE published
2017-02-01
Original CVE updated
2026-05-13
Advisory published
2017-02-01
Advisory updated
2026-05-13

Who should care

Security and application teams operating IBM Kenexa LMS on Cloud, especially administrators responsible for web front ends, access controls, log monitoring, and patch management.

Technical summary

NVD classifies the weakness as CWE-22 (Path Traversal). The affected IBM Kenexa LMS versions listed in the record are 4.1, 4.2, 4.2.2, 4.2.3, 4.2.4, 5.0, 5.1, and 5.2. The CVSS v3.0 vector is AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, reflecting network reachability, low attack complexity, no user interaction, and high confidentiality impact from unauthorized file disclosure.

Defensive priority

Medium. The CVSS score is 6.5, but the issue is remote and can expose sensitive files. Treat as prompt remediation for any deployed affected version.

Recommended defensive actions

  • Confirm whether any affected IBM Kenexa LMS versions listed in the NVD record are deployed.
  • Apply the IBM vendor guidance referenced by NVD (support document uid=swg21992072) or the latest available fix.
  • Review web access logs for requests containing ../ or other path traversal patterns.
  • Restrict exposure of LMS endpoints where practical, including limiting network access to administrative interfaces.
  • Assess whether sensitive files could have been accessible and investigate for unauthorized file reads if suspicious activity is found.

Evidence notes

All claims are limited to the supplied NVD record and linked references. The record identifies IBM Kenexa LMS on Cloud as affected, lists the vulnerable versions, and cites an IBM patch/vendor advisory plus a SecurityFocus entry as references. No KEV entry, ransomware linkage, or exploit details were provided in the source corpus.

Sources and references

Verified primary and authoritative sources

  • CVE-2016-8933 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2016-8933

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2016-8933 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2016-8933

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.