CVE-2010-0714

26.02.2010, 19:30

Cross-site scripting (XSS) vulnerability in login.jsp in IBM WebSphere Portal, IBM Lotus Web Content Management (WCM), and IBM Lotus Workplace Web Content Management 5.1.0.0 through 5.1.0.5, 6.0.0.0 through 6.0.0.4, 6.0.1.0 through 6.0.1.7, 6.1.0.0 through 6.1.0.3, and 6.1.5.0; and IBM Lotus Quickr services 8.0, 8.0.0.2, 8.1, 8.1.1, and 8.1.1.1 for WebSphere Portal; allows remote attackers to inject arbitrary web script or HTML via the query string.

Cross-site Scripting

Severity

UNKNOWN

AV:N/AC:M/Au:N/C:N/I:P/A:N

Atk. Vector

NETWORK

Atk. Complexity

MEDIUM

Base Score

CVSS 3.x

EPSS Score

Percentile: Unknown

Vendor	Product	Version
ibm	websphere_portal	5.1.0.0
ibm	websphere_portal	5.1.0.1
ibm	websphere_portal	5.1.0.2
ibm	websphere_portal	5.1.0.3
ibm	websphere_portal	5.1.0.4
ibm	websphere_portal	5.1.0.5
ibm	websphere_portal	6.0.0.0
ibm	websphere_portal	6.0.0.1
ibm	websphere_portal	6.0.0.2
ibm	websphere_portal	6.0.0.3
ibm	websphere_portal	6.0.0.4
ibm	websphere_portal	6.0.1.0
ibm	websphere_portal	6.0.1.1
ibm	websphere_portal	6.0.1.2
ibm	websphere_portal	6.0.1.3
ibm	websphere_portal	6.0.1.4
ibm	websphere_portal	6.0.1.5
ibm	websphere_portal	6.0.1.6
ibm	websphere_portal	6.0.1.7
ibm	websphere_portal	6.1.0.0
ibm	websphere_portal	6.1.0.1
ibm	websphere_portal	6.1.0.2
ibm	websphere_portal	6.1.0.3
ibm	websphere_portal	6.1.5.0
ibm	lotus_web_content_management	5.1.0.0
ibm	lotus_web_content_management	5.1.0.1
ibm	lotus_web_content_management	5.1.0.2
ibm	lotus_web_content_management	5.1.0.3
ibm	lotus_web_content_management	5.1.0.4
ibm	lotus_web_content_management	5.1.0.5
ibm	lotus_web_content_management	6.0.0.0
ibm	lotus_web_content_management	6.0.0.1
ibm	lotus_web_content_management	6.0.0.2
ibm	lotus_web_content_management	6.0.0.3
ibm	lotus_web_content_management	6.0.0.4
ibm	lotus_web_content_management	6.0.1.0
ibm	lotus_web_content_management	6.0.1.1
ibm	lotus_web_content_management	6.0.1.2
ibm	lotus_web_content_management	6.0.1.3
ibm	lotus_web_content_management	6.0.1.4
ibm	lotus_web_content_management	6.0.1.5
ibm	lotus_web_content_management	6.0.1.6
ibm	lotus_web_content_management	6.0.1.7
ibm	lotus_web_content_management	6.1.0.0
ibm	lotus_web_content_management	6.1.0.1
ibm	lotus_web_content_management	6.1.0.2
ibm	lotus_web_content_management	6.1.0.3
ibm	lotus_web_content_management	6.1.5.0
ibm	lotus_workplace_web_content_management	5.1.0.0
ibm	lotus_workplace_web_content_management	5.1.0.1
ibm	lotus_workplace_web_content_management	5.1.0.2
ibm	lotus_workplace_web_content_management	5.1.0.3
ibm	lotus_workplace_web_content_management	5.1.0.4
ibm	lotus_workplace_web_content_management	5.1.0.5
ibm	lotus_workplace_web_content_management	6.0.0.0
ibm	lotus_workplace_web_content_management	6.0.0.1
ibm	lotus_workplace_web_content_management	6.0.0.2
ibm	lotus_workplace_web_content_management	6.0.0.3
ibm	lotus_workplace_web_content_management	6.0.0.4
ibm	lotus_workplace_web_content_management	6.0.1.0
ibm	lotus_workplace_web_content_management	6.0.1.1
ibm	lotus_workplace_web_content_management	6.0.1.2
ibm	lotus_workplace_web_content_management	6.0.1.3
ibm	lotus_workplace_web_content_management	6.0.1.4
ibm	lotus_workplace_web_content_management	6.0.1.5
ibm	lotus_workplace_web_content_management	6.0.1.6
ibm	lotus_workplace_web_content_management	6.0.1.7
ibm	lotus_workplace_web_content_management	6.1.0.0
ibm	lotus_workplace_web_content_management	6.1.0.1
ibm	lotus_workplace_web_content_management	6.1.0.2
ibm	lotus_workplace_web_content_management	6.1.0.3
ibm	lotus_workplace_web_content_management	6.1.5.0
ibm	lotus_quickr	8.0
ibm	lotus_quickr	8.0.0.2
ibm	lotus_quickr	8.1
ibm	lotus_quickr	8.1.1
ibm	lotus_quickr	8.1.1.1

𝑥

= Vulnerable software versions

Known Exploits!

Common Weakness Enumeration

CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The software does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

References

http://www-01.ibm.com/support/docview.wss?uid=swg21421469

http://www-1.ibm.com/support/docview.wss?uid=swg1PM03233

http://www.hacktics.com/content/advisories/AdvIBM20100224.html

http://www.securityfocus.com/archive/1/509744/100/0/threaded

http://www.securityfocus.com/bid/38412

http://www.securitytracker.com/id?1023660

https://exchange.xforce.ibmcloud.com/vulnerabilities/56508