{"api_version":"1","generated_at":"2026-07-23T06:09:19+00:00","cve":"CVE-2013-3979","urls":{"html":"https://cve.report/CVE-2013-3979","api":"https://cve.report/api/cve/CVE-2013-3979.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2013-3979","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2013-3979"},"summary":{"title":"CVE-2013-3979","description":"Multiple cross-site scripting (XSS) vulnerabilities in the help pages in Web\\Content\\Help\\ in the Web Client in IBM Cognos Command Center (aka Star Command Center or Star Analytics) before 10.1, when Internet Explorer is used, allow remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.","state":"PUBLISHED","assigner":"ibm","published_at":"2013-07-25 11:59:07","updated_at":"2026-04-29 01:13:23"},"problem_types":["CWE-79","n/a"],"metrics":[{"version":"2.0","source":"nvd@nist.gov","type":"Primary","score":"3.5","severity":"","vector":"AV:N/AC:M/Au:S/C:N/I:P/A:N","data":{"version":"2.0","vectorString":"AV:N/AC:M/Au:S/C:N/I:P/A:N","baseScore":3.5,"accessVector":"NETWORK","accessComplexity":"MEDIUM","authentication":"SINGLE","confidentialityImpact":"NONE","integrityImpact":"PARTIAL","availabilityImpact":"NONE"}}],"references":[{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/84904","name":"https://exchange.xforce.ibmcloud.com/vulnerabilities/84904","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"IBM X-Force Exchange","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://secunia.com/advisories/54286","name":"http://secunia.com/advisories/54286","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"Security Advisory SA54286 - IBM Cognos Command Center Unspecified Cross-Site Scripting Vulnerability - Secunia","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www-01.ibm.com/support/docview.wss?uid=swg21643067","name":"http://www-01.ibm.com/support/docview.wss?uid=swg21643067","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Vendor Advisory"],"title":"IBM notice: The page you requested cannot be displayed","mime":"text/html","httpstatus":"404","archivestatus":"410"},{"url":"http://www.securityfocus.com/bid/61419","name":"http://www.securityfocus.com/bid/61419","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"IBM Cognos Command Center Unspecified Cross Site Scripting Vulnerability","mime":"text/html","httpstatus":"200","archivestatus":"0"},{"url":"http://www.securitytracker.com/id/1028829","name":"http://www.securitytracker.com/id/1028829","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"IBM Cognos Star Command Center Input Validation Flaw Permits Cross-Site Scripting Attacks - SecurityTracker","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://www.cve.org/CVERecord?id=CVE-2013-3979","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2013-3979","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"n/a","product":"n/a","version":"affected n/a","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2013","cve_id":"3979","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"ibm","cpe5":"star_command_center","cpe6":"1.6.1","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2013","cve_id":"3979","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"ibm","cpe5":"star_command_center","cpe6":"3.0.0","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2013","cve_id":"3979","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"ibm","cpe5":"star_command_center","cpe6":"3.0.1","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2013","cve_id":"3979","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"ibm","cpe5":"star_command_center","cpe6":"3.0.2","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2013","cve_id":"3979","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"ibm","cpe5":"star_command_center","cpe6":"3.0.3","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2013","cve_id":"3979","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"ibm","cpe5":"star_command_center","cpe6":"3.0.4","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2013","cve_id":"3979","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"ibm","cpe5":"star_command_center","cpe6":"3.0.5","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2013","cve_id":"3979","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"ibm","cpe5":"star_command_center","cpe6":"3.0.6","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2013","cve_id":"3979","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"ibm","cpe5":"star_command_center","cpe6":"3.0.7","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2013","cve_id":"3979","vulnerable":"0","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"microsoft","cpe5":"internet_explorer","cpe6":"-","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"adp":[{"providerMetadata":{"dateUpdated":"2024-08-06T16:30:49.372Z","orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE"},"references":[{"name":"1028829","tags":["vdb-entry","x_refsource_SECTRACK","x_transferred"],"url":"http://www.securitytracker.com/id/1028829"},{"name":"cognoscc-cve20133979-xss(84904)","tags":["vdb-entry","x_refsource_XF","x_transferred"],"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/84904"},{"name":"61419","tags":["vdb-entry","x_refsource_BID","x_transferred"],"url":"http://www.securityfocus.com/bid/61419"},{"tags":["x_refsource_CONFIRM","x_transferred"],"url":"http://www-01.ibm.com/support/docview.wss?uid=swg21643067"},{"name":"54286","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred"],"url":"http://secunia.com/advisories/54286"}],"title":"CVE Program Container"}],"cna":{"affected":[{"product":"n/a","vendor":"n/a","versions":[{"status":"affected","version":"n/a"}]}],"datePublic":"2013-07-23T00:00:00.000Z","descriptions":[{"lang":"en","value":"Multiple cross-site scripting (XSS) vulnerabilities in the help pages in Web\\Content\\Help\\ in the Web Client in IBM Cognos Command Center (aka Star Command Center or Star Analytics) before 10.1, when Internet Explorer is used, allow remote authenticated users to inject arbitrary web script or HTML via unspecified vectors."}],"problemTypes":[{"descriptions":[{"description":"n/a","lang":"en","type":"text"}]}],"providerMetadata":{"dateUpdated":"2017-08-28T12:57:01.000Z","orgId":"9a959283-ebb5-44b6-b705-dcc2bbced522","shortName":"ibm"},"references":[{"name":"1028829","tags":["vdb-entry","x_refsource_SECTRACK"],"url":"http://www.securitytracker.com/id/1028829"},{"name":"cognoscc-cve20133979-xss(84904)","tags":["vdb-entry","x_refsource_XF"],"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/84904"},{"name":"61419","tags":["vdb-entry","x_refsource_BID"],"url":"http://www.securityfocus.com/bid/61419"},{"tags":["x_refsource_CONFIRM"],"url":"http://www-01.ibm.com/support/docview.wss?uid=swg21643067"},{"name":"54286","tags":["third-party-advisory","x_refsource_SECUNIA"],"url":"http://secunia.com/advisories/54286"}],"x_legacyV4Record":{"CVE_data_meta":{"ASSIGNER":"psirt@us.ibm.com","ID":"CVE-2013-3979","STATE":"PUBLIC"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"n/a","version":{"version_data":[{"version_value":"n/a"}]}}]},"vendor_name":"n/a"}]}},"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"Multiple cross-site scripting (XSS) vulnerabilities in the help pages in Web\\Content\\Help\\ in the Web Client in IBM Cognos Command Center (aka Star Command Center or Star Analytics) before 10.1, when Internet Explorer is used, allow remote authenticated users to inject arbitrary web script or HTML via unspecified vectors."}]},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"n/a"}]}]},"references":{"reference_data":[{"name":"1028829","refsource":"SECTRACK","url":"http://www.securitytracker.com/id/1028829"},{"name":"cognoscc-cve20133979-xss(84904)","refsource":"XF","url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/84904"},{"name":"61419","refsource":"BID","url":"http://www.securityfocus.com/bid/61419"},{"name":"http://www-01.ibm.com/support/docview.wss?uid=swg21643067","refsource":"CONFIRM","url":"http://www-01.ibm.com/support/docview.wss?uid=swg21643067"},{"name":"54286","refsource":"SECUNIA","url":"http://secunia.com/advisories/54286"}]}}}},"cveMetadata":{"assignerOrgId":"9a959283-ebb5-44b6-b705-dcc2bbced522","assignerShortName":"ibm","cveId":"CVE-2013-3979","datePublished":"2013-07-24T14:00:00.000Z","dateReserved":"2013-06-07T00:00:00.000Z","dateUpdated":"2024-08-06T16:30:49.372Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.1"},"nvd":{"publishedDate":"2013-07-25 11:59:07","lastModifiedDate":"2026-04-29 01:13:23","problem_types":["CWE-79","n/a"],"metrics":{"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:M/Au:S/C:N/I:P/A:N","baseScore":3.5,"accessVector":"NETWORK","accessComplexity":"MEDIUM","authentication":"SINGLE","confidentialityImpact":"NONE","integrityImpact":"PARTIAL","availabilityImpact":"NONE"},"baseSeverity":"LOW","exploitabilityScore":6.8,"impactScore":2.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":true}]},"configurations":[{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:ibm:star_command_center:1.6.1:*:*:*:*:*:*:*","matchCriteriaId":"F1BE5A92-80CC-4D58-A5AC-186347017234"},{"vulnerable":true,"criteria":"cpe:2.3:a:ibm:star_command_center:3.0.0:*:*:*:*:*:*:*","matchCriteriaId":"9C2F1631-7740-4581-8D27-CE76ED2A734E"},{"vulnerable":true,"criteria":"cpe:2.3:a:ibm:star_command_center:3.0.1:*:*:*:*:*:*:*","matchCriteriaId":"221868E9-79E1-4D29-B205-29DF95BD1AA9"},{"vulnerable":true,"criteria":"cpe:2.3:a:ibm:star_command_center:3.0.2:*:*:*:*:*:*:*","matchCriteriaId":"6F316E66-F842-4F57-B4C8-0B2D1FCE3C1C"},{"vulnerable":true,"criteria":"cpe:2.3:a:ibm:star_command_center:3.0.3:*:*:*:*:*:*:*","matchCriteriaId":"D1FF8BDF-EDB8-464E-A266-C4ABFB2FB19F"},{"vulnerable":true,"criteria":"cpe:2.3:a:ibm:star_command_center:3.0.4:*:*:*:*:*:*:*","matchCriteriaId":"632C28DE-9281-4AF3-986A-44AD6E7F0A2F"},{"vulnerable":true,"criteria":"cpe:2.3:a:ibm:star_command_center:3.0.5:*:*:*:*:*:*:*","matchCriteriaId":"08E29D10-E4FD-41A3-8A37-C111EFD5DD13"},{"vulnerable":true,"criteria":"cpe:2.3:a:ibm:star_command_center:3.0.6:*:*:*:*:*:*:*","matchCriteriaId":"60E41A55-D3A4-4FB1-92E1-3D19B35E7750"},{"vulnerable":true,"criteria":"cpe:2.3:a:ibm:star_command_center:3.0.7:*:*:*:*:*:*:*","matchCriteriaId":"643D1709-F0CD-403B-8450-13AFB2C330FE"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:a:microsoft:internet_explorer:-:*:*:*:*:*:*:*","matchCriteriaId":"C37BA825-679F-4257-9F2B-CE2318B75396"}]}]}]},"legacy_mitre":{"record":{"CveYear":"2013","CveId":"3979","Ordinal":"1","Title":"CVE-2013-3979","CVE":"CVE-2013-3979","Year":"2013"},"notes":[{"CveYear":"2013","CveId":"3979","Ordinal":"1","NoteData":"Multiple cross-site scripting (XSS) vulnerabilities in the help pages in Web\\Content\\Help\\ in the Web Client in IBM Cognos Command Center (aka Star Command Center or Star Analytics) before 10.1, when Internet Explorer is used, allow remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.","Type":"Description","Title":"CVE-2013-3979"},{"CveYear":"2013","CveId":"3979","Ordinal":"2","NoteData":"2013-07-24","Type":"Other","Title":"Published"},{"CveYear":"2013","CveId":"3979","Ordinal":"3","NoteData":"2017-08-28","Type":"Other","Title":"Modified"}]}}}