CVE-2016-5953

Published: Feb 1, 2017Modified: May 13, 2026

3.7

Vector

CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

Exploitability: 2.2 / Impact: 1.4

Source: NVD

Description

IBM Sterling Order Management transmits the session identifier within the URL. When a user is unable to view a certain view due to not being allowed permissions, the website responds with an error page where the session identifier is encoded as Base64 in the URL.

Affected (6)

Products: Ibm: Sterling Selling And Fulfillment Foundation

Ibm

1 product

Sterling Selling And Fulfillment Foundation

Configuration A

6 vulnerable

Vulnerable Software	Affected Versions
Ibm Sterling Selling And Fulfillment Foundation	Version 9.1.0
Ibm Sterling Selling And Fulfillment Foundation	Version 9.2.0
Ibm Sterling Selling And Fulfillment Foundation	Version 9.2.1
Ibm Sterling Selling And Fulfillment Foundation	Version 9.3
Ibm Sterling Selling And Fulfillment Foundation	Version 9.4
Ibm Sterling Selling And Fulfillment Foundation	Version 9.5