IBM Lotus iNotes E-mail Messages Unspecified HTML Injection Vulnerability

Bugtraq ID:	64445
Class:	Input Validation Error
CVE:	CVE-2013-4063
Remote:	Yes
Local:	No
Published:	Dec 19 2013 12:00AM
Updated:	Dec 19 2013 12:00AM
Credit:	ITekia lab
Vulnerable:
Not Vulnerable:

IBM Lotus iNotes E-mail Messages Unspecified HTML Injection Vulnerability

IBM Lotus iNotes is prone to an unspecified HTML-injection vulnerability because it fails to properly sanitize user-supplied input.

Successful exploits will result in the execution of arbitrary attacker-supplied HTML and script code in the context of the affected application, potentially allowing the attacker to steal cookie-based authentication credentials or control how the page is rendered to the user. Other attacks are also possible.

IBM Lotus iNotes 8.5, 8.5.1, 8.5.2, 8.5.3 prior to 8.5.3 Fix Pack 6 and 9.0 are vulnerable.

IBM Lotus iNotes E-mail Messages Unspecified HTML Injection Vulnerability

An attacker can exploit this issue using a web browser.

IBM Lotus iNotes E-mail Messages Unspecified HTML Injection Vulnerability

Solution:
Updates are available. Please see the references or vendor advisory for more information.

IBM Lotus iNotes E-mail Messages Unspecified HTML Injection Vulnerability

References:

• IBM Homepage (IBM)