IBM WebSphere Portal Unspecified Reflected XSS (PI30620)

low Nessus Plugin ID 82851

Language:

Synopsis

The remote Windows host has web portal software installed that is affected by a cross-site scripting vulnerability.

Description

The version of IBM WebSphere Portal installed on the remote host is affected by an unspecified cross-site scripting vulnerability due to improper validation of user-supplied input. A remote attacker can exploit this flaw using a specially crafted URL to execute arbitrary script code in a user's web browser within the security context of the hosting website. This allows an attacker to steal a user's cookie-based authentication credentials.

Solution

Upgrade to IBM WebSphere Portal 6.1.0.6 CF27 / 6.1.5.3 CF27 / 7.0.0.2 CF29 / 8.0.0.1 CF15 or later. Alternatively, apply interim fix PI30620.

Plugin Details

Severity: Low

ID: 82851

File Name: websphere_portal_cve-2014-8909.nasl

Version: 1.7

Type: local

Family: CGI abuses

Published: 4/17/2015

Updated: 1/19/2021

Supported Sensors: Nessus

Risk Information

VPR

Risk Factor: Low

Score: 3.0

CVSS v2

Risk Factor: Low

Base Score: 3.5

Temporal Score: 3

Vector: CVSS2#AV:N/AC:M/Au:S/C:N/I:P/A:N

Vulnerability Information

CPE: cpe:/a:ibm:websphere_portal

Required KB Items: installed_sw/IBM WebSphere Portal

Exploit Ease: No exploit is required

Patch Publication Date: 2/2/2015

Vulnerability Publication Date: 2/2/2015

Reference Information

CVE: CVE-2014-8909

BID: 73958

Detections

Analytics