Detections
Analytics
IBM WebSphere eXtreme Scale 8.6.1.0 <= 8.6.2.2 Multiple Vulnerabilities (7293764)
critical Nessus Plugin ID 379382
Synopsis
The remote web application server is affected by multiple vulnerabilities.Description
The version of IBM WebSphere eXtreme Scale installed on the remote host is 8.6.1.0 through 8.6.2.2. Its Liberty deployment is, therefore, affected by multiple vulnerabilities as referenced in the 7293764 advisory.- IBM WebSphere Extreme Scale 8.6.1.0 through 8.6.2.2 could allow a remote attacker to bypass security restrictions due to improper Content Security Policy configuration. (CVE-2026-101117)
- Node.js C3.js c3 module is vulnerable to cross-site scripting, caused by improper validation of user-supplied input by the tooltip. A remote attacker could exploit this vulnerability to inject malicious script into a Web page which would be executed in a victim's Web browser within the security context of the hosting Web site, once the page is viewed. An attacker could use this vulnerability to steal the victim's cookie-based authentication credentials. (CVE-2016-1000240)
- In jQuery versions greater than or equal to 1.0.3 and before 3.5.0, passing HTML containing option elements from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. .html(), .append(), and others) may execute untrusted code. This problem is patched in jQuery 3.5.0.
(CVE-2020-11023)
Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number. The vendor fix is delivered as an interim fix that does not change the reported product version, so Nessus cannot confirm whether it has been applied.
Solution
Apply interim fix PH73641. Installations below 8.6.2.2 must first be upgraded to fix pack 8.6.2.2 before the interim fix is applied. See the vendor advisory for details.See Also
Plugin Details
Severity: Critical
ID: 379382
File Name: ibm_websphere_xsld_7293764.nasl
Version: 1.1
Type: Local
Agent: unix
Family: Web Servers
Published: 11/12/2026
Updated: 11/12/2026
Configuration: Enable paranoid mode
Supported Sensors: Nessus Agent, Nessus
Risk Information
VPR
Risk Factor: Medium
Score: 5.1
Percentile: 96.42
CVSS v2
Risk Factor: High
Base Score: 9.4
Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:N
CVSS Score Source: CVE-2026-101117
CVSS v3
Risk Factor: Critical
Base Score: 9.1
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Vulnerability Information
CPE: cpe:/a:ibm:websphere_extreme_scale
Required KB Items: Settings/ParanoidReport, installed_sw/IBM WebSphere eXtreme Scale
Patch Publication Date: 10/23/2026
Vulnerability Publication Date: 10/23/2026