IBM BladeCenter Advanced Management Module CVE-2013-4007 Cross Site Scripting Vulnerability

Bugtraq ID:	61749
Class:	Input Validation Error
CVE:	CVE-2013-4007
Remote:	Yes
Local:	No
Published:	Aug 12 2013 12:00AM
Updated:	Aug 12 2013 12:00AM
Credit:	Jens Regel of Schneider & Wulf EVD-Beratung
Vulnerable:	IBM BladeCenter Advanced Management Module 3.64B build BPET64B IBM BladeCenter Advanced Management Module 3.54P Build BPET54P IBM BladeCenter Advanced Management Module 1.42U build BPET42U IBM BladeCenter Advanced Management Module 1.42U build BBET42U
Not Vulnerable:	IBM BladeCenter Advanced Management Module 3.64G build BPET64G IBM BladeCenter Advanced Management Module 3.64G build BBET64G

IBM BladeCenter Advanced Management Module CVE-2013-4007 Cross Site Scripting Vulnerability

IBM BladeCenter Advanced Management Module is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and launch other attacks.

IBM BladeCenter Advanced Management Module running firmware versions prior to 3.64G build BBET64G and 3.64G build BPET64G are vulnerable.

IBM BladeCenter Advanced Management Module CVE-2013-4007 Cross Site Scripting Vulnerability

To exploit this issue an attacker must entice an unsuspecting victim to open a malicious URI.

IBM BladeCenter Advanced Management Module CVE-2013-4007 Cross Site Scripting Vulnerability

Solution:
Updates are available. Please see the references or vendor advisory for more information.

IBM BladeCenter Advanced Management Module CVE-2013-4007 Cross Site Scripting Vulnerability

References:

• IBM BladeCenter Advanced Management Module Homepage (IBM)
  
• IBM Homepage (IBM)
  
• Security Bulletin: Vulnerability in IBM Advanced Management Module (CVE-2013-400 (IBM)