IBM WebSphere Service Registry and Repository CVE-2013-6721 HTML Injection Vulnerability

Bugtraq ID:	64301
Class:	Input Validation Error
CVE:	CVE-2013-6721
Remote:	Yes
Local:	No
Published:	Dec 12 2013 12:00AM
Updated:	Dec 12 2013 12:00AM
Credit:	IBM
Vulnerable:	IBM WebSphere Service Registry and Repository 8.0.0.2 IBM WebSphere Service Registry and Repository 8.0.0.1 IBM WebSphere Service Registry and Repository 8.0 IBM WebSphere Service Registry and Repository 7.5.0.3 IBM WebSphere Service Registry and Repository 7.5.0.2 IBM WebSphere Service Registry and Repository 7.5.0.1 IBM WebSphere Service Registry and Repository 7.5
Not Vulnerable:	IBM WebSphere Service Registry and Repository 7.5.0.4

IBM WebSphere Service Registry and Repository CVE-2013-6721 HTML Injection Vulnerability

IBM WebSphere Service Registry and Repository is prone to an HTML-injection vulnerability because it fails to properly sanitize user-supplied input.

Successful exploits will result in the execution of arbitrary attacker-supplied HTML and script code in the context of the affected application, potentially allowing the attacker to steal cookie-based authentication credentials or control how the page is rendered to the user. Other attacks are also possible.

IBM WebSphere Service Registry and Repository versions 7.5 through 7.5.0.3 and 8.0 through 8.0.0.2 are vulnerable.

IBM WebSphere Service Registry and Repository CVE-2013-6721 HTML Injection Vulnerability

An attacker can exploit this issue using a web browser.

IBM WebSphere Service Registry and Repository CVE-2013-6721 HTML Injection Vulnerability

Solution:
Updates are available. Please see the references or vendor advisory for more information.

IBM WebSphere Service Registry and Repository CVE-2013-6721 HTML Injection Vulnerability

References:

• IBM Homepage (IBM)
  
• IBM WebSphere Service Registry and Repository Home Page (IBM)
  
• Security Bulletin WebSphere Service Registry and Repository Script injection vul (IBM)