Multiple IBM Products CVE-2013-5402 Unspecified Cross-Site Scripting Vulnerability

Bugtraq ID:	64333
Class:	Input Validation Error
CVE:	CVE-2013-5402
Remote:	Yes
Local:	No
Published:	Dec 13 2013 12:00AM
Updated:	May 22 2014 11:24AM
Credit:	Pen Test Partners
Vulnerable:	IBM Tivoli Service Request Manager 7.2 IBM Tivoli Service Request Manager 7.1 IBM Tivoli Asset Management for IT 7.2 IBM Tivoli Asset Management for IT 7.1 IBM Maximo Asset Management Essentials 7.5 IBM Maximo Asset Management Essentials 7.1 IBM Maximo Asset Management 7.5 IBM Maximo Asset Management 7.1 IBM Maximo Asset Management 6.2 IBM Change and Configuration Management Database 7.2 IBM Change and Configuration Management Database 7.1
Not Vulnerable:

Multiple IBM Products CVE-2013-5402 Unspecified Cross-Site Scripting Vulnerability

Multiple IBM products are prone to an unspecified cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

Successful exploits will result in the execution of arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks.

Multiple IBM Products CVE-2013-5402 Unspecified Cross-Site Scripting Vulnerability

Attackers can exploit this issue by enticing an unsuspecting victim to follow a malicious URI.

Multiple IBM Products CVE-2013-5402 Unspecified Cross-Site Scripting Vulnerability

Solution:
Updates are available. Please see the references or vendor advisory for more information.

Multiple IBM Products CVE-2013-5402 Unspecified Cross-Site Scripting Vulnerability

References:

• IBM Homepage (IBM)