IBM WebSphere Portal Web Content Viewer Portlet XSS (PM84525)

medium Nessus Plugin ID 73382

Synopsis

The remote Windows host has web portal software installed that is affected by a cross-site scripting vulnerability.

Description

The version of WebSphere Portal on the remote host is affected by a cross-site scripting vulnerability. An attacker can inject arbitrary code into a user's browser which is then executed.

Solution

IBM has published Interim Fix PM84525. This fix is included in 7.0.0.2 CF22 and 8.0.0.x CF05. Refer to IBM's advisory for more information.

See Also

http://www.nessus.org/u?8806f7cc

https://www-304.ibm.com/support/docview.wss?uid=swg21638984

Plugin Details

Severity: Medium

ID: 73382

File Name: websphere_portal_cve-2013-0549.nasl

Version: 1.9

Type: local

Published: 4/7/2014

Updated: 1/19/2021

Supported Sensors: Nessus

Risk Information

VPR

Risk Factor: Low

Score: 1.6

CVSS v2

Risk Factor: Medium

Base Score: 4.3

Temporal Score: 3.7

Vector: CVSS2#AV:N/AC:M/Au:N/C:N/I:P/A:N

CVSS v3

Risk Factor: Medium

Base Score: 4.7

Temporal Score: 4.5

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N

Temporal Vector: CVSS:3.0/E:H/RL:O/RC:C

Vulnerability Information

CPE: cpe:/a:ibm:websphere_portal

Required KB Items: installed_sw/IBM WebSphere Portal

Exploit Ease: No exploit is required

Patch Publication Date: 5/29/2013

Vulnerability Publication Date: 5/29/2013

Reference Information

CVE: CVE-2013-0549

BID: 60231

CWE: 20, 442, 629, 711, 712, 722, 725, 74, 750, 751, 79, 800, 801, 809, 811, 864, 900, 928, 931, 990