PT-2009-3822 · Ibm · Ibm Bladecenter Advanced Management Module

Published 2009-04-13 · Updated 2018-10-10 · CVE-2009-1288

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions IBM BladeCenter Advanced Management Module (AMM) (affected versions not specified)

Description The issue concerns multiple cross-site scripting (XSS) vulnerabilities. These vulnerabilities allow remote attackers to inject arbitrary web script or HTML. This can be achieved via two methods: (1) the username in a login action, or (2) the PATH parameter to "private/file management.ssi" in the File manager.

Recommendations For the IBM BladeCenter Advanced Management Module (AMM), consider restricting access to the login functionality and the File manager until a fix is available. As a temporary workaround, avoid using the username field in login actions and the PATH parameter in "private/file management.ssi" to minimize the risk of exploitation.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2009-1288

Affected Products

Ibm Bladecenter Advanced Management Module

References · 10

• 🔥 https://exploit-db.com/exploits/32894 · Exploit
• 🔥 https://exploit-db.com/exploits/32895 · Exploit
• 🔥 http://securityfocus.com/bid/34447 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2009-1288 · Security Note
• http://securityfocus.com/archive/1/502582/100/0/threaded · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1288 · Note
• http://osvdb.org/53657 · Note
• http://louhinetworks.fi/advisory/ibm_090409.txt · Note
• http://osvdb.org/53658 · Note
• http://securitytracker.com/id?1022025 · Note