PT-2005-5099 · Ibm · Ibm Websphere Application Server

Published 2005-12-20 · Updated 2008-09-05 · CVE-2005-4413

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions IBM WebSphere Application Server 6

Description The issue concerns multiple cross-site scripting (XSS) vulnerabilities in sample scripts. These vulnerabilities allow remote attackers to inject arbitrary web script or HTML. The affected endpoints include: "PlantsByWebSphere/login.jsp" where the E-mail address field is vulnerable, "TechnologySample/BulletinBoard Script" where the message field is vulnerable, "TechnologySamples/Subscription" where the Email address field is vulnerable, and "TechnologySamples/MovieReview2 1" where the Movie Name, Movie Reviewer, and Movie Review fields are vulnerable.

Recommendations For IBM WebSphere Application Server 6, update the sample scripts to validate and sanitize user input in the affected fields to prevent XSS attacks. As a temporary workaround, consider restricting access to the vulnerable sample scripts until a patch is available. Avoid using the vulnerable fields in the affected API endpoints until the issue is resolved.

Fix

Related Identifiers

CVE-2005-4413

Affected Products

Ibm Websphere Application Server

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2005-4413 · Security Note
• http://securitytracker.com/id?1015360 · Note
• http://securityfocus.com/bid/15929 · Note
• http://ipomonis.com/advisories/ibm_css.txt · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-4413 · Note