PT-2007-6764 · Ibm · Ibm Websphere Application Server

Publicado 2007-11-03 · Atualizado 2017-07-29 · CVE-2007-5798

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Média

Vetor base

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions IBM WebSphere Application Server versions prior to 6.1.0 Fix Pack 13

Description The issue concerns multiple cross-site scripting (XSS) vulnerabilities in the UDDI user console. These vulnerabilities allow remote attackers to inject arbitrary web script or HTML via the keyField, nameField, valueField, and frameReturn parameters in the uddigui/navigateTree.do endpoint.

Recommendations For versions prior to 6.1.0 Fix Pack 13, update to 6.1.0 Fix Pack 13 or later to resolve the issue. As a temporary workaround, consider restricting access to the uddigui/navigateTree.do endpoint to minimize the risk of exploitation. Avoid using the keyField, nameField, valueField, and frameReturn parameters in this endpoint until the issue is resolved.

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2007-5798

Produtos afetados

Ibm Websphere Application Server

Referências · 9

• http://securityfocus.com/bid/26276 · Nota
• http://securitytracker.com/id?1018884 · Nota
• http://vupen.com/english/advisories/2007/3672 · Nota
• http://secunia.com/advisories/27448 · Aviso do Fabricante
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-5798 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2007-5798 · Nota de Segurança
• http://www-1.ibm.com/support/docview.wss?uid=swg1PK50245 · Aviso do Fabricante
• https://exchange.xforce.ibmcloud.com/vulnerabilities/38177 · Nota
• http://osvdb.org/41618 · Nota