IBM Eclipse Help System CVE-2013-0464 Cross Site Scripting Vulnerability

Bugtraq ID:	60246
Class:	Input Validation Error
CVE:	CVE-2013-0464
Remote:	Yes
Local:	No
Published:	May 30 2013 12:00AM
Updated:	Sep 01 2014 01:23AM
Credit:	IBM
Vulnerable:	IBM WebSphere MQ File Transfer Edition 7.0 IBM WebSphere MQ 7.0.1 .2 IBM WebSphere MQ 7.0.1 .1 IBM WebSphere MQ 7.0 2 IBM WebSphere MQ 7.0.1.5 IBM WebSphere MQ 7.0.1.4 IBM WebSphere MQ 7.0.1.3 IBM WebSphere MQ 7.0.1.0 IBM WebSphere MQ 7.0.0.1 IBM WebSphere MQ 7.0 IBM Websphere Application Server 8.0 IBM Tivoli Key Lifecycle Manager 1.0 IBM Tivoli Foundations for Application Manager 1.2 IBM Tivoli Foundations for Application Manager 1.1.1 IBM Tivoli Asset Discovery for Distributed 7.2 IBM SPSS Data Collection 6.0.1 IBM SPSS Data Collection 6.0 IBM Content Manager Enterprise Edition 8.4.3 IBM Content Analytics 2.2 IBM Application Manager for Smart Business 1.2.1
Not Vulnerable:

IBM Eclipse Help System CVE-2013-0464 Cross Site Scripting Vulnerability

IBM Eclipse Help System is prone to a cross-site scripting vulnerability.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and launch other attacks.

IBM Eclipse Help System versions 3.4.3 and 3.6.2 are vulnerable.

IBM Eclipse Help System CVE-2013-0464 Cross Site Scripting Vulnerability

To exploit this issue an attacker must entice an unsuspecting victim to open a malicious URI.

IBM Eclipse Help System CVE-2013-0464 Cross Site Scripting Vulnerability

Solution:
Updates are available. Please see the references or vendor advisory for more information.

IBM Eclipse Help System CVE-2013-0464 Cross Site Scripting Vulnerability

References:

• IBM Homepage (IBM)