IBM Emptoris Sourcing Multiple Cross Site Scripting and Open Redirection Vulnerabilities
BID:100486
Info
IBM Emptoris Sourcing Multiple Cross Site Scripting and Open Redirection Vulnerabilities
| Bugtraq ID: | 100486 |
| Class: | Input Validation Error |
| CVE: |
CVE-2017-1447 CVE-2017-1449 CVE-2017-1450 CVE-2017-1444 |
| Remote: | Yes |
| Local: | No |
| Published: | Jul 11 2017 12:00AM |
| Updated: | Jul 11 2017 12:00AM |
| Credit: | IBM |
| Vulnerable: |
IBM Emptoris Sourcing 10.1.3 IBM Emptoris Sourcing 10.1.1 IBM Emptoris Sourcing 10.1 IBM Emptoris Sourcing 10.0.2 IBM Emptoris Sourcing 10.0.1 IBM Emptoris Sourcing 9.5 IBM Emptoris Sourcing 10.0.4 |
| Not Vulnerable: | |
Discussion
IBM Emptoris Sourcing Multiple Cross Site Scripting and Open Redirection Vulnerabilities
IBM Emptoris Sourcing is prone to multiple cross-site scripting and open-redirection vulnerabilities.
An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site and steal cookie-based authentication credentials, or craft a URI and entice a user to follow the link to redirect victim to an attacker-controlled site and conduct phishing attacks.
IBM Emptoris Sourcing is prone to multiple cross-site scripting and open-redirection vulnerabilities.
An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site and steal cookie-based authentication credentials, or craft a URI and entice a user to follow the link to redirect victim to an attacker-controlled site and conduct phishing attacks.
Solution / Fix
IBM Emptoris Sourcing Multiple Cross Site Scripting and Open Redirection Vulnerabilities
Solution:
Updates are available. Please see the references or vendor advisory for more information.
Solution:
Updates are available. Please see the references or vendor advisory for more information.