IBM Sametime Classic Meeting Server CVE-2013-0535 Unspecified Cross Site Scripting Vulnerability

Bugtraq ID:	59597
Class:	Input Validation Error
CVE:	CVE-2013-0535
Remote:	Yes
Local:	No
Published:	Apr 29 2013 12:00AM
Updated:	Apr 29 2013 12:00AM
Credit:	Christian Frei
Vulnerable:	IBM Sametime Classic Meeting Server 8.5.2 1 IBM Sametime Classic Meeting Server 8.5.1 2 IBM Sametime Classic Meeting Server 8.0.2 IBM Sametime Classic Meeting Server 8.0.1 IBM Sametime Classic Meeting Server 7.5.1 2 IBM Sametime Classic Meeting Server 8.5
Not Vulnerable:

IBM Sametime Classic Meeting Server CVE-2013-0535 Unspecified Cross Site Scripting Vulnerability

IBM Sametime Classic Meeting Server is prone to an unspecified cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks.

IBM Sametime Classic Meeting Server 8.5.2.1 and prior versions are affected.

IBM Sametime Classic Meeting Server CVE-2013-0535 Unspecified Cross Site Scripting Vulnerability

An attacker can exploit this issue by enticing an unsuspecting user to follow a malicious URI.

IBM Sametime Classic Meeting Server CVE-2013-0535 Unspecified Cross Site Scripting Vulnerability

Solution:
Updates are available. Please see the references or vendor advisory for more information.

IBM Sametime Classic Meeting Server CVE-2013-0535 Unspecified Cross Site Scripting Vulnerability

References:

• Fix available for potential cross-site scripting (XSS) security vulnerabilities (IBM)
  
• Security Bulletin: Vulnerability in Classic Sametime Meetings Server (CVE-2013- (IBM)
  
• Sametime Classic Meeting Server Homepage (IBM)