PT-2013-5521 · Microsoft+1 · Windows+2

Published 2013-12-21 · Updated 2017-08-29 · CVE-2013-5406

Positive Technologies (AI Summary)

CVSS v2.0

3.5

Low

Base vector

AV:N/AC:M/Au:S/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions IBM Sterling B2B Integrator version 5.2 IBM Sterling File Gateway version 2.2

Description The issue allows remote authenticated users to inject arbitrary web script or HTML via unspecified parameters. This leads to improper interaction with the Windows MHTML protocol handler, potentially resulting in cross-site scripting (XSS) attacks.

Recommendations For IBM Sterling B2B Integrator version 5.2, update to a version that addresses the XSS vulnerabilities. For IBM Sterling File Gateway version 2.2, update to a version that addresses the XSS vulnerabilities. As a temporary workaround, consider restricting access to unspecified parameters to minimize the risk of exploitation.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2013-5406

Affected Products

Ibm Sterling B2B Integrator

Ibm Sterling File Gateway

Windows

References · 5

• http://www-01.ibm.com/support/docview.wss?uid=swg1IC96055 · Vendor Advisory
• http://www-01.ibm.com/support/docview.wss?uid=swg21657539 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2013-5406 · Security Note
• http://securityfocus.com/bid/64446 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/87355 · Note