Servers and applications
CVE-2016-3042
Cross-site scripting (XSS) vulnerability in the Web UI in IBM WebSphere Application Server (WAS) Liberty before 16.0.0.3 allows remote authenticated users to inject arbitrary web script or HTML via vectors involving OpenID Connect clients.
- Severity
- Medium 5.4
- Published
- 1 Oct 2016
- Last changed
- 17 Jun 2026
- Added to UpHeron
- 1 Nov 2026
- Exploit chance
- 1.1% in the next 30 daysHigher than 66% of CVEs. EPSS by FIRST, 11 Nov 2026
- Weakness
- Cross-site scripting (CWE-79)
- Attack
- Over the network · Needs a user account · Needs someone to click or open something
- Attacker can
- Read some data · Change some data
- CVSS vector
CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N- Sources
- NVD
Affected software
| Software | Affected versions |
|---|---|
IBM WebSphere Application ServerServers and applications · cpe:a:ibm:websphere_application_server |
|