{"id":"CVE-2016-0377","aliases":["EUVD-2016-0412","GHSA-q723-9g7p-28r9"],"status":"published","title":"The Administrative Console in IBM WebSphere Application Server (WAS) 7.x before 7.0.0.43, 8.0.x...","description":"The Administrative Console in IBM WebSphere Application Server (WAS) 7.x before 7.0.0.43, 8.0.x before 8.0.0.13, and 8.5.x before 8.5.5.10 mishandles CSRFtoken cookies, which allows remote authenticated users to obtain sensitive information via unspecified vectors.","severity":{"version":"3.0","score":4.3,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-07","score":0.0154,"percentile":0.75059,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-200"],"published":"2016-10-22T01:00:00Z","modified":"2026-06-17T00:37:25Z","products":[{"vendor":"ibm","product":"websphere_application_server"}],"references":[{"url":"http://www.securitytracker.com/id/1036653","tags":["vdb-entry","x_refsource_SECTRACK","x_transferred"]},{"url":"http://www.securityfocus.com/bid/92514","tags":["vdb-entry","x_refsource_BID","x_transferred"]},{"url":"http://www-01.ibm.com/support/docview.wss?uid=swg1PI56917","tags":["vendor-advisory","x_refsource_AIXAPAR","x_transferred","Broken Link"]},{"url":"http://www-01.ibm.com/support/docview.wss?uid=swg21980645","tags":["x_refsource_CONFIRM","x_transferred","Patch","Vendor Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-0377"},{"url":"https://github.com/advisories/GHSA-q723-9g7p-28r9"}],"sources":{"cve":[{"id":"CVE-2016-0377","description":"The Administrative Console in IBM WebSphere Application Server (WAS) 7.x before 7.0.0.43, 8.0.x before 8.0.0.13, and 8.5.x before 8.5.5.10 mishandles CSRFtoken cookies, which allows remote authenticated users to obtain sensitive information via unspecified vectors.","status":"published","published":"2016-10-22T01:00:00Z","modified":"2024-08-05T22:15:24.304Z","updated_at":"2026-11-02T14:33:37.12286Z"}],"euvd":[{"id":"EUVD-2016-0412","description":"The Administrative Console in IBM WebSphere Application Server (WAS) 7.x before 7.0.0.43, 8.0.x before 8.0.0.13, and 8.5.x before 8.5.5.10 mishandles CSRFtoken cookies, which allows remote authenticated users to obtain sensitive information via unspecified vectors.","status":"published","published":"2016-10-22T01:00:00Z","modified":"2024-08-05T22:15:24Z","updated_at":"2026-11-03T02:23:01.297813Z"}],"ghsa":[{"id":"GHSA-q723-9g7p-28r9","title":"The Administrative Console in IBM WebSphere Application Server (WAS) 7.x before 7.0.0.43, 8.0.x...","description":"The Administrative Console in IBM WebSphere Application Server (WAS) 7.x before 7.0.0.43, 8.0.x before 8.0.0.13, and 8.5.x before 8.5.5.10 mishandles CSRFtoken cookies, which allows remote authenticated users to obtain sensitive information via unspecified vectors.","status":"published","published":"2022-05-17T02:13:32Z","modified":"2023-01-27T05:04:12Z","cvss":[{"version":"3.0","score":4.3,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T14:42:24.641814Z"}],"nvd":[{"id":"CVE-2016-0377","description":"The Administrative Console in IBM WebSphere Application Server (WAS) 7.x before 7.0.0.43, 8.0.x before 8.0.0.13, and 8.5.x before 8.5.5.10 mishandles CSRFtoken cookies, which allows remote authenticated users to obtain sensitive information via unspecified vectors.","status":"published","published":"2016-10-22T03:59:11.58Z","modified":"2026-06-17T00:37:25.603Z","cvss":[{"version":"3.0","score":4.3,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"primary"},{"version":"2.0","score":4,"vector":"AV:N/AC:L/Au:S/C:P/I:N/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T14:03:31.485755Z"}]}}