PT-2004-2356 · Ibm · Ibm Net.Data+1

Publicado 2004-12-31 · Atualizado 2017-07-12 · CVE-2004-1442

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Média

Vetor base

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions: IBM Net.Data versions 7 and 7.2

Description: A cross-site scripting (XSS) issue exists due to improper handling of error messages, such as "DTWP001E", by the db2www CGI interpreter. This allows remote attackers to inject arbitrary web script or HTML via a macro filename.

Recommendations: For IBM Net.Data versions 7 and 7.2, consider disabling the db2www CGI interpreter until a patch is available to prevent exploitation of this issue. Restrict access to error messages that could be used to inject malicious scripts, such as those containing "DTWP001E".

Exploit

Correção

Identificadores relacionados

CVE-2004-1442

Produtos afetados

Ibm Net.Data

Db2Www

Referências · 11

• 🔥 http://securityfocus.com/bid/9488 · Exploit
• 🔥 https://exploit-db.com/exploits/23598 · Exploit
• http://securitytracker.com/id?1008845 · Nota
• http://kb.cert.org/vuls/id/DMOA-5VNPEL · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2004-1442 · Nota de Segurança
• http://kb.cert.org/vuls/id/197318 · Nota
• http://archives.neohapsis.com/archives/vulnwatch/2004-q1/0019.html · Nota
• http://osvdb.org/3712 · Nota
• http://secunia.com/advisories/10709 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/14925 · Nota
• http://secunia.com/secunia_research/2004-1/advisory · Nota