CVE-2016-9704 IBM CVE debrief

Who should care

Administrators and security teams running IBM Security Identity Manager Virtual Appliance, especially the versions listed by NVD as vulnerable. This is also relevant to any team that relies on the appliance Web UI for privileged administration, since XSS in an admin console can impact trusted sessions and credentials.

Technical summary

NVD maps this issue to CWE-79 and lists the CVSS v3.0 vector as CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N, which matches a network-reachable XSS that requires user interaction. The vulnerable product entries in NVD include IBM Security Identity Manager Virtual Appliance versions 7.0.0.0 through 7.0.1.4. IBM’s referenced advisory and NVD both identify the problem as a Web UI XSS affecting user-supplied content rendered in a trusted browser context.

Defensive priority

Medium. The score is 6.1 and the attack requires user interaction, but the impact can include session abuse and credential exposure in an administrative web interface.

Recommended defensive actions

• Review IBM’s advisory referenced by NVD and apply the vendor-recommended update or patch for IBM Security Identity Manager Virtual Appliance.
• Inventory deployments to confirm whether any instances are running versions 7.0.0.0 through 7.0.1.4.
• Treat the Web UI as a high-value administrative surface and restrict access to trusted users and networks.
• Validate that session handling, authentication controls, and browser-based administrative workflows are monitored for anomalous behavior.
• Use browser and application defenses that reduce XSS impact, such as output encoding and Content Security Policy where supported.
• If immediate patching is not possible, limit exposure of the management interface until remediation is complete.

Evidence notes

Claims in this debrief are limited to the supplied NVD record and the referenced IBM/SecurityFocus/SecurityTracker links. NVD identifies the weakness as CWE-79, gives the CVSS v3.0 vector AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N, and enumerates vulnerable IBM Security Identity Manager Virtual Appliance versions 7.0.0.0 through 7.0.1.4. The description supplied by NVD states that arbitrary JavaScript can be embedded in the Web UI and may lead to credentials disclosure within a trusted session.

Official resources