PT-2017-13811 · Ibm · Ibm Worklight Framework

Gabriele Gristina · Publicado 2017-08-01 · Atualizado 2017-08-04 · CVE-2017-1500

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Média

Vetor base

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions IBM Worklight Framework versions 6.1 through 8.0

Description A Reflected Cross Site Scripting (XSS) issue exists in the authorization function of the RESTful Web Api. The scope parameter is vulnerable; if its value is set to a "realm" not defined in authenticationConfig.xml, it will be reflected in the HTTP response body. This allows for the injection of arbitrary JavaScript code, potentially modifying the authorization flow and leading to credential disclosure within a trusted session.

Recommendations For IBM Worklight Framework versions 6.1 through 8.0, as a temporary workaround, consider restricting the use of the scope parameter in the authorization function until a patch is available. Avoid setting the scope parameter to arbitrary values, especially those that could be interpreted as JavaScript code, to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2017-1500

Produtos afetados

Ibm Worklight Framework

Referências · 4

• http://www-01.ibm.com/support/docview.wss?uid=swg2C1000316 · Aviso do Fabricante
• https://exchange.xforce.ibmcloud.com/vulnerabilities/129404 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2017-1500 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2017-1500 · Aviso do Fabricante