Lucene search
K
Database
Vendors
Products
Years
CVSS
Scanner
Agent Scanning
API Scanning
Manual Audit
Perimeter Scanner
Scanning
Projects
Email
Webhook
Plugins
Resources
Documents
Blog
Glossary
FAQ
Pricing
Contacts
About Us
Partners
Branding Guideline
ibmIBM88C4CE6BFFC688CDBA1A6EDD4B70C98E0BCD85DBB7839BA64B64D9EC2A8BB485
HistoryJun 25, 2024 - 4:18 p.m.

Security Bulletin: IBM Cloud Transformation Advisor is vulnerable to cross-site scripting due to WebSphere Application Server Liberty

2024-06-2516:18:56
www.ibm.com
4
ibm
cloud transformation advisor
cross-site scripting
websphere application server liberty
vulnerability
cve-2024-27270
affected products
remediation
install v3.10.0

4.7 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N

6.4 Medium

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

9.1%

JSON

Summary

There is a vulnerability in IBM WebSphere Application Server Liberty used by IBM Cloud Transformation Advisor (CVE-2024-27270).

Vulnerability Details

CVEID:CVE-2024-27270
**DESCRIPTION:**IBM WebSphere Application Server Liberty 23.0.0.3 through 24.0.0.3 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in a specially crafted URI. IBM X-Force ID: 284576.
CVSS Base score: 4.7
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/284576 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N)

Affected Products and Versions

Affected Product(s) Version(s)
IBM Cloud Transformation Advisor 2.0.1 - 3.9.0

Remediation/Fixes

IBM strongly recommends addressing the vulnerability now.

Product(s) Version(s) Remediation/Fix/Instructions
IBM Cloud Transformation Advisor 2.0.1 - 3.9.0 Install v3.10.0 from OperatorHub page in Red Hat OpenShift Container Platform or locally following this link.

Workarounds and Mitigations

None

Affected configurations

Vulners
Node
ibmcloud_transformation_advisorMatch3.
CPENameOperatorVersion
ibm cloud transformation advisoreq3.

Related

nvd 1
ibm 14
cvelist 1
cnvd 1
nessus 1
cve 1
nvd
nvd
CVE-2024-27270
2024-03-27 13:15:47
ibm
ibm
Security Bulletin: IBM WebSphere Application Server Liberty, which is bundled with IBM Cloud Pak for Applications, is vulnerable to cross-site scripting (CVE-2024-27270)
2024-04-03 19:34:11
Security Bulletin: The IBM® Engineering Lifecycle Engineering product using IBM WebSphere Application Server Liberty is vulnerable to cross-site scripting (CVE-2024-27270)
2024-04-22 06:07:56
Security Bulletin: IBM WebSphere Application Server Liberty, which is bundled with IBM WebSphere Hybrid Edition, is vulnerable to cross-site scripting (CVE-2024-27270)
2024-04-03 19:40:12
cvelist
cvelist
CVE-2024-27270 IBM WebSphere Application Server Liberty cross-site scripting
2024-03-27 12:42:52
cnvd
cnvd
IBM WebSphere Application Server Liberty Cross-Site Scripting Vulnerability (CNVD-2024-15727)
2024-03-29 00:00:00
nessus
nessus
IBM WebSphere Application Server Liberty 23.0.0.3 < 24.0.0.4 XSS (7145231)
2024-03-27 00:00:00
cve
cve
CVE-2024-27270
2024-03-27 13:15:47

4.7 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N

6.4 Medium

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

9.1%

JSON
Related for 88C4CE6BFFC688CDBA1A6EDD4B70C98E0BCD85DBB7839BA64B64D9EC2A8BB485
nvd1ibm14cvelist1cnvd1nessus1cve1