IBM Tivoli Service Automation Manager Multiple Cross Site Scripting Vulnerabilities

Bugtraq ID:	65185
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Jan 24 2014 12:00AM
Updated:	Jan 24 2014 12:00AM
Credit:	IBM
Vulnerable:	IBM Tivoli Service Automation Manager (TSAM) 7.2.4 3 IBM Tivoli Service Automation Manager (TSAM) 7.2.4 2 IBM Tivoli Service Automation Manager (TSAM) 7.2.4 1
Not Vulnerable:	IBM Tivoli Service Automation Manager (TSAM) 7.2.4.4

IBM Tivoli Service Automation Manager Multiple Cross Site Scripting Vulnerabilities

IBM Tivoli Service Automation Manager is prone to multiple cross-site scripting vulnerabilities because it fails to sanitize user-supplied input.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and launch other attacks.

Versions prior to IBM IBM Tivoli Service Automation Manager 7.2.4.4 are affected.

IBM Tivoli Service Automation Manager Multiple Cross Site Scripting Vulnerabilities

Solution:
Updates are available. Please see the references or vendor advisory for more information.

IBM Tivoli Service Automation Manager Multiple Cross Site Scripting Vulnerabilities

References:

• IBM Homepage (IBM)
  
• Tivoli Service Automation Manager Fix Pack 4 - 7.2.4-TIV-TSAM-FP0004 (IBM)
  
• Tivoli Service Automation Manager Homepage (IBM)