IBM WebSphere Application Server Administration Console Cross Site Scripting Vulnerability

Bugtraq ID:	55149
Class:	Input Validation Error
CVE:	CVE-2012-3293
Remote:	Yes
Local:	No
Published:	Aug 21 2012 12:00AM
Updated:	Mar 19 2015 09:06AM
Credit:	The vendor reported this issue.
Vulnerable:	IBM Websphere Application Server 8.0 2 IBM Websphere Application Server 7.0 21 IBM Websphere Application Server 7.0 .2 IBM Websphere Application Server 7.0 .13 IBM Websphere Application Server 7.0 .12 IBM Websphere Application Server 7.0 .11 IBM Websphere Application Server 6.1 41 IBM Websphere Application Server 6.1 .4 IBM Websphere Application Server 6.1 .32 IBM Websphere Application Server 6.1 .3 IBM Websphere Application Server 6.1 .25 IBM Websphere Application Server 6.1 .23 IBM Websphere Application Server 6.1 .22 IBM Websphere Application Server 6.1 .21 IBM Websphere Application Server 6.1 .20 IBM Websphere Application Server 6.1 .2 IBM Websphere Application Server 6.1 .19 IBM Websphere Application Server 6.1 .18 IBM Websphere Application Server 6.1 .17 IBM Websphere Application Server 6.1 .15 IBM Websphere Application Server 6.1 .14 IBM Websphere Application Server 6.1 .13 IBM Websphere Application Server 6.1 .12 IBM Websphere Application Server 6.1 .11 IBM Websphere Application Server 6.1 .10 IBM Websphere Application Server 6.1 .1 IBM Websphere Application Server 8.0.0.1 IBM Websphere Application Server 8.0.0.0 IBM Websphere Application Server 7.0.0.23 IBM Websphere Application Server 7.0.0.19 IBM Websphere Application Server 7.0.0.17 IBM Websphere Application Server 7.0.0.15 IBM Websphere Application Server 7.0.0.14 IBM Websphere Application Server 7.0.0.13 IBM Websphere Application Server 7.0.0.1 IBM Websphere Application Server 7.0.0.0 IBM Websphere Application Server 6.1.0.43 IBM Websphere Application Server 6.1.0.39 IBM Websphere Application Server 6.1.0.37 IBM Websphere Application Server 6.1.0.35 IBM Websphere Application Server 6.1.0.34 IBM Websphere Application Server 6.1.0.33 IBM Websphere Application Server 6.1.0.31 IBM Websphere Application Server 6.1.0.29 IBM Websphere Application Server 6.1.0.27
Not Vulnerable:	IBM Websphere Application Server 8.0.0.4 IBM Websphere Application Server 6.1.0.45

IBM WebSphere Application Server Administration Console Cross Site Scripting Vulnerability

IBM WebSphere Application Server is prone to a cross-site scripting vulnerability.

An attacker can exploit this issue to execute arbitrary script code within the context of the application and steal cookie-based authentication credentials. Other attacks are also possible.

IBM WebSphere Application Server Administration Console Cross Site Scripting Vulnerability

Attackers can exploit this issue by enticing an unsuspecting victim to follow a malicious URI.

IBM WebSphere Application Server Administration Console Cross Site Scripting Vulnerability

Solution:
Vendor updates are available; please see the references for more information.

IBM WebSphere Application Server Administration Console Cross Site Scripting Vulnerability

References:

• IBM Homepage (IBM)
  
• Security Bulletin: Security Vulnerabilities fixed in IBM WebSphere Application S (IBM)
  
• Security Vulnerabilities fixed in IBM WebSphere Application Server 8.5.0.1 (IBM)