PT-2014-3896 · Ibm · Ibm Websphere Portal+1

Published 2014-02-14 · Updated 2017-08-29 · CVE-2014-0855

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions IBM Connections Portlets versions prior to 4.5.1 FP1 IBM WebSphere Portal versions 7.0.0.2 and 8.0.0.1

Description The issue allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, which can lead to multiple cross-site scripting (XSS) vulnerabilities.

Recommendations For IBM Connections Portlets versions prior to 4.5.1 FP1, update to version 4.5.1 FP1 or later. For IBM WebSphere Portal versions 7.0.0.2 and 8.0.0.1, consider restricting access to sensitive areas of the portal until an update or patch is available.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2014-0855

Affected Products

Ibm Connections Portlets

Ibm Websphere Portal

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2014-0855 · Security Note
• http://www-01.ibm.com/support/docview.wss?uid=swg21663921 · Vendor Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/90802 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0855 · Note