Cross site scripting

2017-02-0822:59:00

PRIOn knowledge base

www.prio-n.com

6.6 Medium

AI Score

Confidence

Low

0.0004 Low

EPSS

Percentile

12.7%

JSON

A vulnerability has been identified in IBM Cloud Orchestrator services/[action]/launch API. An authenticated domain admin user might modify cross domain resources via a /services/[action]/launch API call, provided it would have been possible for the domain admin user to gain access to a resource identifier of the other domain.

CPENameOperatorVersion
cloud_orchestratoreq2.4
cloud_orchestratoreq2.5.01
cloud_orchestratoreq2.5
cloud_orchestratoreq2.4.0.3
cloud_orchestratoreq2.4.0.2
cloud_orchestratoreq2.4.0.1
smartcloud_orchestratoreq2.3.0.1
smartcloud_orchestratoreq2.3

Name	Operator	Version
cloud_orchestrator	eq	2.4
cloud_orchestrator	eq	2.5.01
cloud_orchestrator	eq	2.5
cloud_orchestrator	eq	2.4.0.3
cloud_orchestrator	eq	2.4.0.2
cloud_orchestrator	eq	2.4.0.1
smartcloud_orchestrator	eq	2.3.0.1
smartcloud_orchestrator	eq	2.3