Lucene search
K
Database
Vendors
Products
Years
CVSS
Scanner
Agent Scanning
API Scanning
Manual Audit
Perimeter Scanner
Scanning
Projects
Email
Webhook
Plugins
Resources
Documents
Blog
Glossary
FAQ
Pricing
Contacts
About Us
Partners
Branding Guideline
ibmIBM3338DC95220D2E7488A5EECF8C3CB0E737C1D3739387EC9FA725E0249DD8FB24
HistoryJul 01, 2020 - 1:42 a.m.

Security Bulletin: Rational Asset Analyzer (RAA) is affected by a WebSphere Application Server vulnerability

2020-07-0101:42:40
www.ibm.com
4

6.1 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

4.3 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

JSON

Summary

Asset Analyzer (RAA) has addressed the following vulnerability. IBM WebSphere Application Server was affected by a cross-site scripting.

Vulnerability Details

CVEID:CVE-2019-17573
**DESCRIPTION:**Apache CXF is vulnerable to cross-site scripting, caused by improper validation of user-supplied input by the services listing page. A remote attacker could exploit this vulnerability using a specially-crafted URL to execute script in a victim’s Web browser within the security context of the hosting Web site, once the URL is clicked. An attacker could use this vulnerability to steal the victim’s cookie-based authentication credentials.
CVSS Base score: 6.1
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/174689 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)

Affected Products and Versions

Affected Product(s) Version(s)
Rational Asset Analyzer (RAA) 6.1.0.0 - 6.1.0.23

Remediation/Fixes

Product VRMF APAR Remediation / First Fix
Rational Asset Analyzer 6.1.0.23 Refresh NONE RAA 6.1.0.23 Refresh for Windows

RAA 6.1.0.23 Refresh for z/OS

Workarounds and Mitigations

None

Related

ibm 18
prion 2
veracode 1
osv 4
cve 2
redhat 15
github 2
redhatcve 2
nessus 6
oracle 2
ibm
ibm
Security Bulletin: IBM Cloud Private is vulnerable to an IBM WebSphere Application Server Liberty vulnerability (CVE-2019-17573)
2020-08-18 21:02:30
Security Bulletin: Vulnerability in Apache CXF affects WebSphere Application Server (CVE-2019-17573)
2020-03-19 18:00:13
Security Bulletin: Vulnerability in Apache CXF affects WebSphere Application Server shipped with IBM WebSphere Application Server Patterns (CVE-2019-17573)
2020-03-19 20:08:16
prion
prion
Cross site scripting
2020-01-16 18:15:00
Cross site scripting
2020-11-12 13:15:00
veracode
veracode
Cross-Site Scripting (XSS)
2020-01-17 07:24:12
osv
osv
CVE-2019-17573
2020-01-16 18:15:11
Reflected Cross-Site Scripting in Apache CXF
2020-06-10 20:02:33
CVE-2020-13954
2020-11-12 13:15:11
cve
cve
CVE-2019-17573
2020-01-16 18:15:00
CVE-2020-13954
2020-11-12 13:15:00
redhat
redhat
(RHSA-2020:0824) Moderate: Open Liberty 20.0.0.3 Runtime security update
2020-03-16 15:56:42
(RHSA-2020:2112) Important: Red Hat Single Sign-On 7.3.8 security update
2020-05-12 17:03:07
(RHSA-2020:2058) Important: Red Hat JBoss Enterprise Application Platform 7.2.8 on RHEL 6 security update
2020-05-11 19:52:46
github
github
Reflected Cross-Site Scripting in Apache CXF
2020-06-10 20:02:33
Cross-site scripting in Apache CXF
2021-04-22 16:15:23
redhatcve
redhatcve
CVE-2019-17573
2020-01-31 18:39:12
CVE-2020-13954
2020-11-16 17:10:35
nessus
nessus
RHEL 8 : Red Hat JBoss Enterprise Application Platform 7.2.8 on RHEL 8 (RHSA-2020:2060)
2020-05-12 00:00:00
RHEL 6 : Red Hat JBoss Enterprise Application Platform 7.2.8 on RHEL 6 (RHSA-2020:2058)
2020-05-12 00:00:00
RHEL 7 : Red Hat JBoss Enterprise Application Platform 7.2.8 on RHEL 7 (RHSA-2020:2059)
2020-05-12 00:00:00
oracle
oracle
Oracle Critical Patch Update Advisory - April 2021
2021-04-20 00:00:00
Oracle Critical Patch Update Advisory - July 2020
2020-07-14 00:00:00

6.1 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

4.3 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

JSON
Related for 3338DC95220D2E7488A5EECF8C3CB0E737C1D3739387EC9FA725E0249DD8FB24
ibm18prion2veracode1osv4cve2redhat15github2redhatcve2nessus6oracle2