IBM Hardware Management Console (HMC) 'Help Link' Cross Site Scripting Vulnerability

Bugtraq ID:	55121
Class:	Input Validation Error
CVE:	CVE-2012-3296
Remote:	Yes
Local:	No
Published:	Aug 17 2012 12:00AM
Updated:	Aug 17 2012 12:00AM
Credit:	CitiGroup, Inc
Vulnerable:	IBM Hardware Management Console (HMC) 7R7.3.0 IBM Hardware Management Console (HMC) 7R7.2.0 SP1 IBM Hardware Management Console (HMC) 7R7.2.0 IBM Hardware Management Console (HMC) 7R7.1.0 SP3 IBM Hardware Management Console (HMC) 7R7.1.0
Not Vulnerable:	IBM Hardware Management Console (HMC) 7R7.2.0 SP2 IBM Hardware Management Console (HMC) 7R7.1.0 SP4

IBM Hardware Management Console (HMC) 'Help Link' Cross Site Scripting Vulnerability

IBM Hardware Management Console (HMC) is prone to a cross-site scripting vulnerability because the application fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and launch other attacks.

The following versions are vulnerable:

IBM Hardware Management Console 7R7.1.0 through versions prior to 7R7.1.0 SP4
IBM Hardware Management Console 7R7.2.0 through versions prior to 7R7.2.0 SP2
IBM Hardware Management Console 7R7.3.0

IBM Hardware Management Console (HMC) 'Help Link' Cross Site Scripting Vulnerability

References:

• CVE-2012-3296:IBM HMC cross-site scripting vulnerability (NIST)
  
• IBM Hardware Management Console HomePage (IBM)