PT-2014-7045 · Ibm · Ibm Tivoli Directory Server+1

Brennan Brazeau + 4 · Published 2014-10-19 · Updated 2017-09-08 · CVE-2014-6100

Positive Technologies (AI Summary)

CVSS v2.0

3.5

Low

Base vector

AV:N/AC:M/Au:S/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions IBM Tivoli Directory Server versions 6.1 before 6.1.0.64-ISS-ITDS-IF0064 IBM Tivoli Directory Server versions 6.2 before 6.2.0.39-ISS-ITDS-FP0039 IBM Tivoli Directory Server versions 6.3 before 6.3.0.33-ISS-ITDS-IF0033 IBM Security Directory Server versions 6.3.1 before 6.3.1.7-ISS-ISDS-IF0007

Description A cross-site scripting (XSS) issue exists in the Admin UI, allowing remote authenticated users to inject arbitrary web script or HTML via a crafted URL.

Recommendations For IBM Tivoli Directory Server version 6.1, update to 6.1.0.64-ISS-ITDS-IF0064 or later. For IBM Tivoli Directory Server version 6.2, update to 6.2.0.39-ISS-ITDS-FP0039 or later. For IBM Tivoli Directory Server version 6.3, update to 6.3.0.33-ISS-ITDS-IF0033 or later. For IBM Security Directory Server version 6.3.1, update to 6.3.1.7-ISS-ISDS-IF0007 or later.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2014-6100

Affected Products

Ibm Security Directory Server

Ibm Tivoli Directory Server

References · 4

• http://www-01.ibm.com/support/docview.wss?uid=swg21686581 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2014-6100 · Security Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/96005 · Note
• http://secunia.com/advisories/61061 · Note