PT-2008-1987 · Ibm · Ibm Lotus Sametime

Published 2008-01-18 · Updated 2017-08-08 · CVE-2008-0354

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions IBM Lotus Sametime versions 7.5 through 7.5.1

Description The issue is related to a cross-site scripting (XSS) vulnerability in the chat client. This vulnerability allows remote attackers to inject arbitrary web script or HTML via a crafted message. The code execution is triggered after a mouseover event initiated by the victim.

Recommendations For IBM Lotus Sametime versions 7.5 through 7.5.1, consider disabling the chat client functionality until a patch is available to prevent exploitation of the XSS vulnerability. Restrict access to the chat client to minimize the risk of code injection. Avoid using the chat client for sensitive communications until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2008-0354

Affected Products

Ibm Lotus Sametime

References · 7

• http://secunia.com/advisories/27942 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2008-0354 · Security Note
• http://www-1.ibm.com/support/docview.wss?uid=swg21292938 · Note
• http://securitytracker.com/id?1019224 · Note
• http://vupen.com/english/advisories/2008/0168 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/39726 · Note
• http://securityfocus.com/bid/27316 · Note