PT-2008-2809 · Ibm · Ibm Lotus Quickr+1

Publicado 2008-03-09 · Atualizado 2018-10-11 · CVE-2008-1216

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Média

Vetor base

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions IBM Lotus Quickr version 8.0 IBM Lotus QuickPlace versions 7.x

Description The issue allows remote attackers to inject arbitrary web script or HTML via a Calendar OpenDocument action to "main.nsf" with a Count parameter containing a JavaScript event in a malformed element. This can be demonstrated by an onload event in an IFRAME element.

Recommendations For IBM Lotus Quickr version 8.0, update the software to properly identify URIs containing cross-site scripting attack strings. For IBM Lotus QuickPlace versions 7.x, restrict access to the Calendar OpenDocument action until a proper fix is applied. As a temporary workaround, consider disabling the onload event in IFRAME elements to minimize the risk of exploitation.

Correção

RCE

Enumeração de Fraquezas

CWE-20

Identificadores relacionados

CVE-2008-1216

Produtos afetados

Ibm Lotus Quickplace

Ibm Lotus Quickr

Referências · 6

• http://secunia.com/advisories/29072 · Nota
• http://securityfocus.com/archive/1/488620/100/100/threaded · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2008-1216 · Nota de Segurança
• http://securityreason.com/securityalert/3721 · Nota
• http://vupen.com/english/advisories/2008/0667 · Nota
• http://securityfocus.com/bid/27925 · Nota