CVE-2021-20562

🗓️ 27 Jul 2021 11:25:17Reported by ibmType

cve🔗 web.nvd.nist.gov📰️ 5 Media mentions👁 75 Views🌐 WEB

IBM Sterling B2B Integrator Standard Edition 5.2.0.0 through 5.2.6.5_3 and 6.1.0.0 through 6.1.0.2 vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 199232

Reporter	Title	Published	Views	Family All 11
0day.today	IBM Sterling B2B Integrator Cross Site Scripting Vulnerability	6 Nov 202100:00	–	zdt
IBM Security Bulletins	Security Bulletin: XSS Security Vulnerabilty Affects Mailbox UI of IBM Sterling B2B Integrator (CVE-2021-20562)	13 May 202214:58	–	ibm
Circl	CVE-2021-20562	27 Jul 202116:12	–	circl
CNNVD	IBM Sterling B2B Integrator 跨站脚本漏洞	26 Jul 202100:00	–	cnnvd
CNVD	IBM Sterling B2B Integrator Cross-Site Scripting Vulnerability (CNVD-2021-58256)	28 Jul 202100:00	–	cnvd
Cvelist	CVE-2021-20562	27 Jul 202111:25	–	cvelist
EUVD	EUVD-2021-7980	3 Oct 202520:07	–	euvd
NVD	CVE-2021-20562	27 Jul 202112:15	–	nvd
OSV	CVE-2021-20562	27 Jul 202112:15	–	osv
Packet Storm	IBM Sterling B2B Integrator Cross Site Scripting	5 Nov 202100:00	–	packetstorm

NVD

Vulners

Node

ibm sterling_b2b_integratorRange5.2.0.0–5.2.6.5_3standard

ibm sterling_b2b_integratorRange6.1.0.0–6.1.0.2standard

AND

hp hp-uxMatch-

ibm aixMatch-

ibm iMatch-

linux linux_kernelMatch-

microsoft windowsMatch-

oracle solarisMatch--

[
  {
    "product": "Sterling B2B Integrator",
    "vendor": "IBM",
    "versions": [
      {
        "status": "affected",
        "version": "5.2.0.0"
      },
      {
        "status": "affected",
        "version": "6.1.0.0"
      },
      {
        "status": "affected",
        "version": "6.1.0.2"
      },
      {
        "status": "affected",
        "version": "5.2.6.5_3"
      }
    ]
  }
]

Source	Link
packetstormsecurity	www.packetstormsecurity.com/files/164782/IBM-Sterling-B2B-Integrator-Cross-Site-Scripting.html
exchange	www.exchange.xforce.ibmcloud.com/vulnerabilities/199232
seclists	www.seclists.org/fulldisclosure/2021/Nov/16
ibm	www.ibm.com/support/pages/node/6475301

Parameter	Position	Path	Description	CWE
securetoken	query param	/mailbox/jsp/MBIList.jsp	Reflected XSS via securetoken in MBIList.jsp	CWE-79
securetoken	query param	/mailbox/jsp/MBISearch.jsp	Reflected XSS via securetoken in MBISearch.jsp	CWE-79
securetoken	query param	/mailbox/jsp/MBISend.jsp	Reflected XSS via securetoken in MBISend.jsp	CWE-79

21 Nov 2024 05:46Current

5.2Medium risk

Vulners AI Score5.2

CVSS 23.5

CVSS 3.15.4

CVSS 35.4

EPSS0.00715

CWE-79