IBM Operational Decision Manager Cross Site Scripting and Cross Site Request Forgery Vulnerabilities
BID:66186
Info
IBM Operational Decision Manager Cross Site Scripting and Cross Site Request Forgery Vulnerabilities
| Bugtraq ID: | 66186 |
| Class: | Input Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Mar 12 2014 12:00AM |
| Updated: | Mar 12 2014 12:00AM |
| Credit: | The vendor reported these issues. |
| Vulnerable: |
IBM Operational Decision Manager 7.5.0.4 IBM Operational Decision Manager 7.5.0.3 |
| Not Vulnerable: | |
Discussion
IBM Operational Decision Manager Cross Site Scripting and Cross Site Request Forgery Vulnerabilities
IBM Operational Decision Manager is prone to a cross-site scripting vulnerability and a cross-site request-forgery vulnerability.
An attacker may exploit these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site, steal cookie-based authentication credentials, perform unauthorized actions, and disclose or modify sensitive information. Other attacks may also be possible.
IBM Operational Decision Manager 7.5.0.3 and 7.5.0.4 are vulnerable.
IBM Operational Decision Manager is prone to a cross-site scripting vulnerability and a cross-site request-forgery vulnerability.
An attacker may exploit these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site, steal cookie-based authentication credentials, perform unauthorized actions, and disclose or modify sensitive information. Other attacks may also be possible.
IBM Operational Decision Manager 7.5.0.3 and 7.5.0.4 are vulnerable.
Exploit / POC
IBM Operational Decision Manager Cross Site Scripting and Cross Site Request Forgery Vulnerabilities
To exploit these issues an attacker must entice an unsuspecting victim into following a malicious URI or visiting a malicious website.
To exploit these issues an attacker must entice an unsuspecting victim into following a malicious URI or visiting a malicious website.
Solution / Fix
IBM Operational Decision Manager Cross Site Scripting and Cross Site Request Forgery Vulnerabilities
Solution:
Updates are available. Please see the references or vendor advisory for more information.
Solution:
Updates are available. Please see the references or vendor advisory for more information.