PT-2005-5099 · Ibm · Ibm Websphere Application Server

Publicado 2005-12-20 · Atualizado 2008-09-05 · CVE-2005-4413

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Média

Vetor base

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions IBM WebSphere Application Server 6

Description The issue concerns multiple cross-site scripting (XSS) vulnerabilities in sample scripts. These vulnerabilities allow remote attackers to inject arbitrary web script or HTML. The affected endpoints include: "PlantsByWebSphere/login.jsp" where the E-mail address field is vulnerable, "TechnologySample/BulletinBoard Script" where the message field is vulnerable, "TechnologySamples/Subscription" where the Email address field is vulnerable, and "TechnologySamples/MovieReview2 1" where the Movie Name, Movie Reviewer, and Movie Review fields are vulnerable.

Recommendations For IBM WebSphere Application Server 6, update the sample scripts to validate and sanitize user input in the affected fields to prevent XSS attacks. As a temporary workaround, consider restricting access to the vulnerable sample scripts until a patch is available. Avoid using the vulnerable fields in the affected API endpoints until the issue is resolved.

Correção

Identificadores relacionados

CVE-2005-4413

Produtos afetados

Ibm Websphere Application Server

Referências · 5

• http://securitytracker.com/id?1015360 · Nota
• http://securityfocus.com/bid/15929 · Nota
• http://ipomonis.com/advisories/ibm_css.txt · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2005-4413 · Nota de Segurança
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-4413 · Nota