Lucene search

[email protected]CVE-2017-1189

HistorySep 07, 2017 - 4:29 p.m.

CVE-2017-1189

2017-09-0716:29:00

CWE-79

[email protected]

web.nvd.nist.gov

ibm websphere

web content manager

xss

cross-site scripting

security vulnerability

nvd

ibm x-force id 123558

4.3 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

6.1 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

5.8 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

47.6%

JSON

IBM WebSphere Portal and Web Content Manager 6.1, 7.0, and 8.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 123558.

Affected configurations

NVD

Node

ibmwebsphere_portalMatch6.1.0.0

ibmwebsphere_portalMatch6.1.0.1

ibmwebsphere_portalMatch6.1.0.2

ibmwebsphere_portalMatch6.1.0.3

ibmwebsphere_portalMatch6.1.0.4

ibmwebsphere_portalMatch6.1.0.5

ibmwebsphere_portalMatch6.1.0.6

ibmwebsphere_portalMatch6.1.5.0

ibmwebsphere_portalMatch6.1.5.1

ibmwebsphere_portalMatch6.1.5.2

ibmwebsphere_portalMatch6.1.5.3

ibmwebsphere_portalMatch7.0.0.0

ibmwebsphere_portalMatch7.0.0.0cf001

ibmwebsphere_portalMatch7.0.0.1

ibmwebsphere_portalMatch7.0.0.1cf002

ibmwebsphere_portalMatch7.0.0.1cf003

ibmwebsphere_portalMatch7.0.0.1cf004

ibmwebsphere_portalMatch7.0.0.1cf005

ibmwebsphere_portalMatch7.0.0.1cf006

ibmwebsphere_portalMatch7.0.0.1cf007

ibmwebsphere_portalMatch7.0.0.1cf008

ibmwebsphere_portalMatch7.0.0.1cf009

ibmwebsphere_portalMatch7.0.0.1cf010

ibmwebsphere_portalMatch7.0.0.1cf019

ibmwebsphere_portalMatch7.0.0.2

ibmwebsphere_portalMatch7.0.0.2cf011

ibmwebsphere_portalMatch7.0.0.2cf012

ibmwebsphere_portalMatch7.0.0.2cf013

ibmwebsphere_portalMatch7.0.0.2cf014

ibmwebsphere_portalMatch7.0.0.2cf015

ibmwebsphere_portalMatch7.0.0.2cf016

ibmwebsphere_portalMatch7.0.0.2cf017

ibmwebsphere_portalMatch7.0.0.2cf018

ibmwebsphere_portalMatch7.0.0.2cf019

ibmwebsphere_portalMatch7.0.0.2cf020

ibmwebsphere_portalMatch7.0.0.2cf021

ibmwebsphere_portalMatch7.0.0.2cf022

ibmwebsphere_portalMatch7.0.0.2cf23

ibmwebsphere_portalMatch7.0.0.2cf24

ibmwebsphere_portalMatch7.0.0.2cf25

ibmwebsphere_portalMatch7.0.0.2cf26

ibmwebsphere_portalMatch7.0.0.2cf27

ibmwebsphere_portalMatch8.0

ibmwebsphere_portalMatch8.0.0.0

ibmwebsphere_portalMatch8.0.0.0cf01

ibmwebsphere_portalMatch8.0.0.0cf02

ibmwebsphere_portalMatch8.0.0.0cf03

ibmwebsphere_portalMatch8.0.0.0cf04

ibmwebsphere_portalMatch8.0.0.0cf05

ibmwebsphere_portalMatch8.0.0.1

ibmwebsphere_portalMatch8.0.0.1cf04

ibmwebsphere_portalMatch8.0.0.1cf05

ibmwebsphere_portalMatch8.0.0.1cf06

ibmwebsphere_portalMatch8.0.0.1cf07

ibmwebsphere_portalMatch8.0.0.1cf08

ibmwebsphere_portalMatch8.0.0.1cf09

ibmwebsphere_portalMatch8.0.0.1cf12

CPENameOperatorVersion
ibm:websphere_portalibm websphere portaleq6.1.0.0
ibm:websphere_portalibm websphere portaleq6.1.0.1
ibm:websphere_portalibm websphere portaleq6.1.0.2
ibm:websphere_portalibm websphere portaleq6.1.0.3
ibm:websphere_portalibm websphere portaleq6.1.0.4
ibm:websphere_portalibm websphere portaleq6.1.0.5
ibm:websphere_portalibm websphere portaleq6.1.0.6
ibm:websphere_portalibm websphere portaleq6.1.5.0
ibm:websphere_portalibm websphere portaleq6.1.5.1
ibm:websphere_portalibm websphere portaleq6.1.5.2

CPE	Name	Operator	Version
ibm:websphere_portal	ibm websphere portal	eq	6.1.0.0
ibm:websphere_portal	ibm websphere portal	eq	6.1.0.1
ibm:websphere_portal	ibm websphere portal	eq	6.1.0.2
ibm:websphere_portal	ibm websphere portal	eq	6.1.0.3
ibm:websphere_portal	ibm websphere portal	eq	6.1.0.4
ibm:websphere_portal	ibm websphere portal	eq	6.1.0.5
ibm:websphere_portal	ibm websphere portal	eq	6.1.0.6
ibm:websphere_portal	ibm websphere portal	eq	6.1.5.0
ibm:websphere_portal	ibm websphere portal	eq	6.1.5.1
ibm:websphere_portal	ibm websphere portal	eq	6.1.5.2

Rows per page:

1-10 of 171

References

www.ibm.com/support/docview.wss?uid=swg22008028

www.securityfocus.com/bid/100699

www.securitytracker.com/id/1039268

exchange.xforce.ibmcloud.com/vulnerabilities/123558

4.3 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

6.1 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

5.8 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

47.6%

JSON

Related for CVE-2017-1189

nessus1 cvelist1 prion1 nvd1