IBM Tivoli Security Information and Event Manager Custom Reports Cross Site Scripting Vulnerability

Bugtraq ID:	49555
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Sep 09 2011 12:00AM
Updated:	Sep 09 2011 12:00AM
Credit:	The vendor reported this issue.
Vulnerable:	IBM Tivoli Security Information and Event Manager 2.0
Not Vulnerable:

IBM Tivoli Security Information and Event Manager Custom Reports Cross Site Scripting Vulnerability

The IBM Tivoli Security Information and Event Manager is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may let the attacker steal cookie-based authentication credentials and launch other attacks.

IBM Tivoli Security Information and Event Manager 2.0 is affected.

IBM Tivoli Security Information and Event Manager Custom Reports Cross Site Scripting Vulnerability

Attackers can exploit this issue by enticing an unsuspecting user to follow a malicious URI.

IBM Tivoli Security Information and Event Manager Custom Reports Cross Site Scripting Vulnerability

Solution:
Updates are available. Pleases see the references for more information.

IBM Tivoli Security Information and Event Manager Custom Reports Cross Site Scripting Vulnerability

References:

• IBM Tivoli Security Information and Event Manager Homepage (IBM)
  
• IV02459: TSIEM TIP COULD BE SUSCEPTIBLE TO A CROSS SITE VULNERABILITY (XSS) (IBM)