PT-2008-1987 · Ibm · Ibm Lotus Sametime

Publicado 2008-01-18 · Atualizado 2017-08-08 · CVE-2008-0354

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Média

Vetor base

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions IBM Lotus Sametime versions 7.5 through 7.5.1

Description The issue is related to a cross-site scripting (XSS) vulnerability in the chat client. This vulnerability allows remote attackers to inject arbitrary web script or HTML via a crafted message. The code execution is triggered after a mouseover event initiated by the victim.

Recommendations For IBM Lotus Sametime versions 7.5 through 7.5.1, consider disabling the chat client functionality until a patch is available to prevent exploitation of the XSS vulnerability. Restrict access to the chat client to minimize the risk of code injection. Avoid using the chat client for sensitive communications until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2008-0354

Produtos afetados

Ibm Lotus Sametime

Referências · 7

• http://www-1.ibm.com/support/docview.wss?uid=swg21292938 · Nota
• http://securitytracker.com/id?1019224 · Nota
• http://secunia.com/advisories/27942 · Aviso do Fabricante
• http://vupen.com/english/advisories/2008/0168 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/39726 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2008-0354 · Nota de Segurança
• http://securityfocus.com/bid/27316 · Nota