IBM Lotus Protector for Mail Security CVE-2014-0884 Unspecified Cross Site Scripting Vulnerability

Bugtraq ID:	66410
Class:	Input Validation Error
CVE:	CVE-2014-0884
Remote:	Yes
Local:	No
Published:	Mar 24 2014 12:00AM
Updated:	Mar 24 2014 12:00AM
Credit:	Alexander Klink
Vulnerable:	IBM Lotus Protector for Mail Security 2.8 0 IBM Lotus Protector for Mail Security 2.8.1.0
Not Vulnerable:

IBM Lotus Protector for Mail Security CVE-2014-0884 Unspecified Cross Site Scripting Vulnerability

IBM Lotus Protector for Mail Security is prone to an unspecified cross-site scripting vulnerability because it fails to sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and launch other attacks.

IBM Lotus Protector for Mail Security 2.8.0.0, and 2.8.1.0 are vulnerable.

IBM Lotus Protector for Mail Security CVE-2014-0884 Unspecified Cross Site Scripting Vulnerability

An attacker can exploit this issue by enticing an unsuspecting user into visiting a specially crafted URL.

IBM Lotus Protector for Mail Security CVE-2014-0884 Unspecified Cross Site Scripting Vulnerability

Solution:
Updates are available. Please see the references or vendor advisory for more information.

IBM Lotus Protector for Mail Security CVE-2014-0884 Unspecified Cross Site Scripting Vulnerability

References:

• IBM Homepage (IBM)
  
• Lotus Protector for Mail Security Homepage (IBM)
  
• Multiple Security Vulnerabilities in Admin Web UI for IBM Lotus Protector for Ma (IBM)