IBM Security Access Manager for Enterprise CVE-2013-6745 Unspecified HTML Injection Vulnerability

Bugtraq ID:	64475
Class:	Input Validation Error
CVE:	CVE-2013-6745
Remote:	Yes
Local:	No
Published:	Dec 20 2013 12:00AM
Updated:	Dec 20 2013 12:00AM
Credit:	IBM
Vulnerable:	IBM IBM Security Access Manager for Enterprise Single Sign-On 8.2
Not Vulnerable:

IBM Security Access Manager for Enterprise CVE-2013-6745 Unspecified HTML Injection Vulnerability

IBM Security Access Manager for Enterprise Single Sign-On is prone to an unspecified HTML-injection vulnerability because it fails to sanitize user-supplied input.

Successful exploits will result in the execution of arbitrary attacker-supplied HTML and script code in the context of the affected application, potentially allowing the attacker to steal cookie-based authentication credentials or control how the page is rendered to the user. Other attacks are also possible

IBM Security Access Manager for Enterprise Single Sign-On 8.2 is vulnerable; other versions may also be affected.

IBM Security Access Manager for Enterprise CVE-2013-6745 Unspecified HTML Injection Vulnerability

An attacker can exploit this issue using a web browser.

IBM Security Access Manager for Enterprise CVE-2013-6745 Unspecified HTML Injection Vulnerability

Solution:
Updates are available. Please see the references or vendor advisory for more information.

IBM Security Access Manager for Enterprise CVE-2013-6745 Unspecified HTML Injection Vulnerability

References:

• IBM Security Access Manager for Enterprise Single Sign-On Homepage (IBM)
  
• Security Bulletin: IBM Security Access Manager for Enterprise Single Sign On Cro (IBM)