IBM WebSphere Application Server 7.0 < / 8.0 < / 8.5 < / 9.0 < Admin Console Multiple XSS

Low Nessus Plugin ID 97355


The remote web application server is affected by multiple XSS vulnerabilities.


The IBM WebSphere Application Server running on the remote host is version 7.0 prior to, 8.0 prior to, 8.5 prior to, or 9.0 prior to It is, therefore, affected by multiple cross-site scripting (XSS) vulnerabilities in the Admin Console due to a failure to validate input before returning it to users. An authenticated, remote attacker can exploit these, via a specially crafted URL, to execute arbitrary script code in a user's browser session within the security context of the hosting website.

Note that Nessus has not checked for the Interim Fix for these issues but has instead relied only on the application's self-reported version number.


Apply IBM WebSphere Application Server version 7.0 Fix Pack 43 ( / 8.0 Fix Pack 14 ( / 8.5 Fix Pack 12 ( / 9.0 Fix Pack 3 ( or later. Alternatively, upgrade to the minimal fix pack levels required by the interim fix and then apply Interim Fix PI73367. See the vendor advisory for more details.

See Also

Plugin Details

Severity: Low

ID: 97355

File Name: websphere_9_0_0_3.nasl

Version: $Revision: 1.5 $

Type: remote

Family: Web Servers

Published: 2017/02/23

Modified: 2017/05/12

Dependencies: 57034

Risk Information

Risk Factor: Low


Base Score: 3.5

Temporal Score: 2.9

Vector: CVSS2#AV:N/AC:M/Au:S/C:N/I:P/A:N

Temporal Vector: CVSS2#E:F/RL:OF/RC:ND


Base Score: 4.1

Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:L/A:N

Vulnerability Information

CPE: cpe:/a:ibm:websphere_application_server

Required KB Items: www/WebSphere, Settings/ParanoidReport

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 2017/02/09

Vulnerability Publication Date: 2016/12/05

Reference Information

CVE: CVE-2016-8934, CVE-2017-1121

BID: 95154, 96164

OSVDB: 148285, 151891