PT-2004-2356 · Ibm · Ibm Net.Data+1

Published 2004-12-31 · Updated 2017-07-12 · CVE-2004-1442

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions: IBM Net.Data versions 7 and 7.2

Description: A cross-site scripting (XSS) issue exists due to improper handling of error messages, such as "DTWP001E", by the db2www CGI interpreter. This allows remote attackers to inject arbitrary web script or HTML via a macro filename.

Recommendations: For IBM Net.Data versions 7 and 7.2, consider disabling the db2www CGI interpreter until a patch is available to prevent exploitation of this issue. Restrict access to error messages that could be used to inject malicious scripts, such as those containing "DTWP001E".

Exploit

Fix

Related Identifiers

CVE-2004-1442

Affected Products

Ibm Net.Data

Db2Www

References · 11

• 🔥 http://securityfocus.com/bid/9488 · Exploit
• 🔥 https://exploit-db.com/exploits/23598 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2004-1442 · Security Note
• http://securitytracker.com/id?1008845 · Note
• http://kb.cert.org/vuls/id/DMOA-5VNPEL · Note
• http://kb.cert.org/vuls/id/197318 · Note
• http://archives.neohapsis.com/archives/vulnwatch/2004-q1/0019.html · Note
• http://osvdb.org/3712 · Note
• http://secunia.com/advisories/10709 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/14925 · Note
• http://secunia.com/secunia_research/2004-1/advisory · Note