PatchSiren

PatchSiren cyber security CVE debrief

CVE-2016-8934 IBM CVE debrief

CVE-2016-8934 is a cross-site scripting flaw in IBM WebSphere Application Server's Web UI. The vulnerability can let an attacker embed arbitrary JavaScript in a trusted web session, altering UI behavior and potentially exposing credentials.

Vendor
IBM
Product
CVE-2016-8934
CVSS
MEDIUM 5.4
CISA KEV
Not listed in stored evidence
Original CVE published
2017-02-01
Original CVE updated
2026-05-13
Advisory published
2017-02-01
Advisory updated
2026-05-13

Who should care

IBM WebSphere Application Server administrators, security teams responsible for exposed Web UI surfaces, and application owners running affected 8.5.5.x or 9.0.0.x deployments, including Liberty profile entries listed by NVD.

Technical summary

NVD identifies this issue as CWE-79 with CVSS 3.0 vector CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N. The NVD CPE criteria list specific affected IBM WebSphere Application Server releases, including 8.5.5.0 through 8.5.5.11 and 9.0.0.0 through 9.0.0.2, with Liberty profile variants present for some entries. The exposure is network-reachable, requires low privileges and user interaction, and primarily impacts confidentiality and integrity through script execution in the Web UI.

Defensive priority

Medium — prioritize during the next maintenance cycle, or sooner if the Web UI is reachable beyond trusted administrative networks.

Recommended defensive actions

  • Review IBM PSIRT advisory swg21995995 for vendor fix guidance and apply the recommended update or mitigation for your exact WebSphere release.
  • Inventory WebSphere Application Server instances and confirm whether any deployed version matches the affected CPE entries listed by NVD.
  • Restrict access to administrative and other sensitive Web UI endpoints to trusted networks and authenticated users only.
  • Validate and encode all user-controlled input rendered in the Web UI to reduce XSS exposure.
  • Verify session handling and credential protection so that injected script cannot disclose secrets within trusted sessions.
  • Retest after patching to confirm the vulnerable UI path is no longer reachable and that custom extensions do not reintroduce script injection.

Evidence notes

Primary evidence comes from the official NVD record and the IBM PSIRT advisory reference included in NVD. The NVD entry provides the CWE-79 classification, the CVSS 3.0 vector, and the affected CPE criteria; the corpus description states that the flaw allows arbitrary JavaScript in the Web UI and may lead to credential disclosure within a trusted session.

Official resources

Publicly disclosed in the official record on 2017-02-01T20:59:02.880Z. The NVD entry was later modified on 2026-05-13T00:24:29.033Z; that modification date is record maintenance, not the original vulnerability date.