IBM Rational Focal Point CVE-2015-0164 Unspecified HTML Injection Vulnerability

Bugtraq ID:	73106
Class:	Input Validation Error
CVE:	CVE-2015-0164
Remote:	Yes
Local:	No
Published:	Mar 13 2015 12:00AM
Updated:	Mar 13 2015 12:00AM
Credit:	Paul Heneghan, NCIA/NCIRC
Vulnerable:	IBM Rational Focal Point 6.5.2 IBM Rational Focal Point 6.5.1 IBM Rational Focal Point 6.6.1.1 IBM Rational Focal Point 6.6.1 IBM Rational Focal Point 6.6.0.1 IBM Rational Focal Point 6.6 IBM Rational Focal Point 6.5.2.3 IBM Rational Focal Point 6.5.2.2 IBM Rational Focal Point 6.5.2.1 IBM Rational Focal Point 6.5.1.1 IBM Rational Focal Point 6.5.0.2 IBM Rational Focal Point 6.5.0.1 IBM Rational Focal Point 6.5
Not Vulnerable:

IBM Rational Focal Point CVE-2015-0164 Unspecified HTML Injection Vulnerability

IBM Rational Focal Point is prone to an unspecified HTML-injection vulnerability.

Successful exploits will result in the execution of arbitrary attacker-supplied HTML and script code in the context of the affected application, potentially allowing the attacker to steal cookie-based authentication credentials or control how the page is rendered to the user. Other attacks are also possible.

IBM Rational Focal Point CVE-2015-0164 Unspecified HTML Injection Vulnerability

Solution:
Updates are available. Please see the references or vendor advisory for more information.

IBM Rational Focal Point CVE-2015-0164 Unspecified HTML Injection Vulnerability

References:

• IBM Rational Focal Point Homepage (IBM)
  
• Security Bulletin: Multiple security vulnerabilities affecting UNICOM Focal Poin (IBM)