IBM WebSphere Application Server SOAP Connector Error Page XSS

Medium Nessus Plugin ID 23649

Synopsis

The remote SOAP server is vulnerable to a cross-site scripting attack.

Description

The remote SOAP server fails to sanitize user input via the URI before using it to generate dynamic XML content in an error page. An unauthenticated, remote attacker may be able to leverage this issue to inject arbitrary XML into a user's browser.

Solution

Apply version 5.0.2 Cumulative Fix 17 / 5.1.1 Cumulative Fix 12 / 6.0.2 Fix Pack 9, depending on the installed version of IBM WebSphere Application Server.

See Also

https://www.securityfocus.com/archive/1/450704/30/0/threaded

http://www-01.ibm.com/support/search.wss?rs=0&q=PK16602&apar=only

Plugin Details

Severity: Medium

ID: 23649

File Name: websphere_soap_faultactor_xss.nasl

Version: 1.22

Type: remote

Published: 2006/11/16

Updated: 2018/11/15

Dependencies: 22477

Risk Information

Risk Factor: Medium

CVSS v2.0

Base Score: 4.3

Temporal Score: 3.7

Vector: CVSS2#AV:N/AC:M/Au:N/C:N/I:P/A:N

Temporal Vector: CVSS2#E:H/RL:OF/RC:C

Vulnerability Information

CPE: cpe:/a:ibm:websphere_application_server

Exploit Available: false

Exploit Ease: No exploit is required

Patch Publication Date: 2006/04/28

Vulnerability Publication Date: 2006/05/10

Reference Information

CVE: CVE-2006-2431

BID: 17919

CWE: 20, 74, 79, 442, 629, 711, 712, 722, 725, 750, 751, 800, 801, 809, 811, 864, 900, 928, 931, 990