Open redirect vulnerability in IBM Eclipse Help System (IEHS), as used in IBM Security AppScan Source 7.x and 8.x before 8.6 and IBM SPSS Data Collection Developer Library 6.0 and 6.0.1, allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors.

According to its banner, the version of Lotus Domino on the remote host is 8.5.x and is, therefore, affected by the following vulnerabilities :

  - Some scripts inside the Web Help application are     vulnerable to open redirect attacks. (CVE-2012-2159)

  - The Web Help component contains a reflected cross-site     scripting vulnerability. (CVE-2012-2161)

  - User-input validation errors exist related to the     'Web Administrator' client as well as the 'Src'     parameter and 'x.nsf' script that could allow cross-site     scripting attacks. (CVE-2013-0488, BID 58715)

  - A user-input validation error exists related to the     'Web Administrator' client that could allow cross-site     request forgery attacks. (CVE-2013-0489)

The remote host has a version of IBM Data Studio installed that is affected by multiple vulnerabilities :

  - An unspecified open-redirect vulnerability exists in the     Eclipse help system components. (CVE-2012-2159)

  - An unspecified cross-site scripting vulnerability exists     in the Eclipse help system components. (CVE-2012-2161)

  - An unspecified vulnerability exists that could allow     disclosure of source code on the help system server.
    (CVE-2013-0467)

IBM WebSphere Application Server 8.5 before Fix Pack 1 appears to be running on the remote host and is, therefore, potentially affected by the following vulnerabilities :

  - An input validation error exists related to the 'Eclipse     Help System' that can allow arbitrary redirect responses     to HTTP requests. (CVE-2012-2159, PM66410)

  - Several errors exist related to SSL/TLS that can allow     an attacker to carry out denial of service attacks     against the application. (CVE-2012-2190, CVE-2012-2191,     PM66218)  
  - Unspecified cross-site scripting issues exist related to     the administrative console. (CVE-2012-3293, PM60839)

  - An unspecified error in the 'ISC Console' can allow a     remote attacker to take over a valid user's session.
    (CVE-2012-3304, PM54356)

  - An unspecified directory traversal error exists that     can allow remote attackers to overwrite files outside     the application's deployment directory. (CVE-2012-3305,     PM62467)

  - When multi-domain support is enabled, the application     does not properly purge passwords from the     authentication cache. (CVE-2012-3306, PM66514)

  - An error exists related to 'Federated Repositories',     'IIOP' connections, 'CBIND' checking and 'Optimized     Local Adapters' that can allow a remote attacker to     bypass security restrictions. Note that this issue     affects the application when running on z/OS.
    (CVE-2012-3311, PM61388)

  - The fix contained in PM44303 contains an error that     can allow an authenticated attacker to bypass security     restrictions and gain administrative access to the     application. (CVE-2012-3325, PM71296) 

  - A request validation error exists related to the proxy     server component that can allow a remote attacker to     cause the proxy status to be reported as disabled thus     denying applications access to the proxy.
    (CVE-2012-3330, PM71319)

  - A request validation error exists related to the     'Liberty Profile' and 'JAX-RS' that can allow a remote     attacker to elevate privileges. (CVE-2012-4850, PM67082)

  - A user-supplied input validation error exists related     to the 'Liberty Profile' that can allow cross-site     scripting attacks to be carried out. (CVE-2012-4851,     PM68643)

  - A user-supplied input validation error exists that can     allow cross-site request forgery (CSRF) attacks to be     carried out. (CVE-2012-4853, PM62920)

The remote host has a version of IBM Rational ClearQuest 7.x prior to 7.1.2.7 / 8.0.0.x prior to 8.0.0.3 installed. It is, therefore, affected by the following vulnerabilities :

  - A cross-site scripting vulnerability exists that can     be exploited by an attacker by tricking a victim into     opening a specially crafted report. (CVE-2012-2205)

  - An information disclosure vulnerability exists that     allows an attacker unauthorized access to password     information. (CVE-2012-2165)

  - ClearQuest Web sometimes displays sensitive stack trace     information in error messages. (CVE-2012-2168)

  - The ClearQuest Web Help component contains a reflected     cross-site scripting vulnerability. (CVE-2012-2161)

  - Some scripts inside the ClearQuest Web Help application     are vulnerable to open redirect attacks. (CVE-2012-2159)

  - The ClearQuest web client is subject to an elevated     privilege attack that allows an attacker access to the     'Site Administration' menu. (CVE-2012-2164)

  - The ClearQuest web client file-upload functionality is     affected by a cross-site scripting vulnerability that     can be exploited by an authenticated user via the 'File     Description' field. (CVE-2012-2169)

  - Attackers can obtain potentially sensitive information     via a request to a 'snoop', 'hello', 'ivt/', 'hitcount',     'HitCount.jsp', 'HelloHTMLError.jsp', 'HelloHTML.jsp',     'HelloVXMLError.jsp', 'HelloWMLError.jsp',     'HellowWML.jsp' or 'cqweb/j_security_check' sample     script. (CVE-2012-0744)

IBM WebSphere Application Server 8.0 before Fix Pack 4 appears to be running on the remote host and is potentially affected by the following vulnerabilities :

  - An input validation error exists related to the 'Eclipse     Help System' that can allow arbitrary redirect responses     to HTTP requests. (CVE-2012-2159, CVE-2012-2161,     PM62795)

  - An error exists related to 'Application Snoop Servlet'     and missing access controls. This error can allow     sensitive information to be disclosed. Note that     exploiting this issue requires that the default     'Application Snoop Servlet' be installed and running.
    (CVE-2012-2170, PM56183)

  - Several errors exist related to SSL/TLS that can allow     an attacker to carry out denial of service attacks     against the application. (CVE-2012-2190, CVE-2012-2191,     PM66218)

  - Unspecified cross-site scripting issues exist related to     the administrative console. (CVE-2012-3293, PM60839)

ID	Name	Product	Family	Severity
66240	IBM Lotus Domino 8.5.x Multiple Vulnerabilities	Nessus	Web Servers	medium
65576	IBM Data Studio 3.1 / 3.1.1 Help System Multiple Vulnerabilities	Nessus	Windows	medium
62975	IBM WebSphere Application Server 8.5 < Fix Pack 1 Multiple Vulnerabilities	Nessus	Web Servers	high
61565	IBM Rational ClearQuest 7.x < 7.1.2.7 / 8.0.0.x < 8.0.0.3 Multiple Vulnerabilities (credentialed check)	Nessus	Windows	medium
61459	IBM WebSphere Application Server 8.0 < Fix Pack 4 Multiple Vulnerabilities	Nessus	Web Servers	medium

Detections

Analytics

CVE-2012-2159

medium

Tenable Plugins

medium

medium

high

medium

medium