Lucene search

[email protected]CVE-2013-3979

HistoryJul 25, 2013 - 11:59 a.m.

CVE-2013-3979

2013-07-2511:59:07

CWE-79

[email protected]

web.nvd.nist.gov

cve-2013-3979

xss

ibm cognos command center

web client

security vulnerabilities

cross-site scripting

help pages

star command center

3.5 Low

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

SINGLE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:S/C:N/I:P/A:N

5.3 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

47.4%

JSON

Multiple cross-site scripting (XSS) vulnerabilities in the help pages in Web\Content\Help\ in the Web Client in IBM Cognos Command Center (aka Star Command Center or Star Analytics) before 10.1, when Internet Explorer is used, allow remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.

Affected configurations

NVD

Node

ibmstar_command_centerMatch1.6.1

ibmstar_command_centerMatch3.0.0

ibmstar_command_centerMatch3.0.1

ibmstar_command_centerMatch3.0.2

ibmstar_command_centerMatch3.0.3

ibmstar_command_centerMatch3.0.4

ibmstar_command_centerMatch3.0.5

ibmstar_command_centerMatch3.0.6

ibmstar_command_centerMatch3.0.7

AND

microsoftinternet_explorerMatch-

CPENameOperatorVersion
ibm:star_command_centeribm star command centereq1.6.1
ibm:star_command_centeribm star command centereq3.0.0
ibm:star_command_centeribm star command centereq3.0.1
ibm:star_command_centeribm star command centereq3.0.2
ibm:star_command_centeribm star command centereq3.0.3
ibm:star_command_centeribm star command centereq3.0.4
ibm:star_command_centeribm star command centereq3.0.5
ibm:star_command_centeribm star command centereq3.0.6
ibm:star_command_centeribm star command centereq3.0.7

CPE	Name	Operator	Version
ibm:star_command_center	ibm star command center	eq	1.6.1
ibm:star_command_center	ibm star command center	eq	3.0.0
ibm:star_command_center	ibm star command center	eq	3.0.1
ibm:star_command_center	ibm star command center	eq	3.0.2
ibm:star_command_center	ibm star command center	eq	3.0.3
ibm:star_command_center	ibm star command center	eq	3.0.4
ibm:star_command_center	ibm star command center	eq	3.0.5
ibm:star_command_center	ibm star command center	eq	3.0.6
ibm:star_command_center	ibm star command center	eq	3.0.7

References

secunia.com/advisories/54286

www-01.ibm.com/support/docview.wss?uid=swg21643067

www.securityfocus.com/bid/61419

www.securitytracker.com/id/1028829

exchange.xforce.ibmcloud.com/vulnerabilities/84904

3.5 Low

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

SINGLE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:S/C:N/I:P/A:N

5.3 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

47.4%

JSON

Related for CVE-2013-3979

prion1 cvelist1 nvd1