Websphere Application Server CVE-2013-0596 Cross-Site Scripting Vulnerability

Bugtraq ID:	73852
Class:	Input Validation Error
CVE:	CVE-2013-0596
Remote:	Yes
Local:	No
Published:	Sep 20 2013 12:00AM
Updated:	Sep 20 2013 12:00AM
Credit:	Unknown
Vulnerable:	IBM Websphere Application Server 6.1 45 IBM Websphere Application Server 6.1 41 IBM Websphere Application Server 6.1 .9 IBM Websphere Application Server 6.1 .7 IBM Websphere Application Server 6.1 .5 IBM Websphere Application Server 6.1 .3 IBM Websphere Application Server 6.1 .2 IBM Websphere Application Server 6.1 .12 IBM Websphere Application Server 6.1 .11 IBM Websphere Application Server 6.1 .1 IBM Websphere Application Server 6.1 IBM Websphere Application Server 6.1.0.43 IBM Websphere Application Server 6.1.0.39 IBM Websphere Application Server 6.1.0.37 IBM Websphere Application Server 6.1.0.35 IBM Websphere Application Server 6.1.0.33
Not Vulnerable:

Websphere Application Server CVE-2013-0596 Cross-Site Scripting Vulnerability

Websphere Application Server is prone to a cross-site scripting vulnerability. Cross-site scripting (XSS) vulnerability in the Administrative console in IBM WebSphere Application Server (WAS) 6.1 before 6.1.0.47 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

Websphere Application Server CVE-2013-0596 Cross-Site Scripting Vulnerability

An attacker can exploit this issue by enticing an unsuspecting victim to follow a malicious URI.

Websphere Application Server CVE-2013-0596 Cross-Site Scripting Vulnerability

Solution:
Updates are available. Please see the references or vendor advisory for more information.

Websphere Application Server CVE-2013-0596 Cross-Site Scripting Vulnerability

References:

• http://www-01.ibm.com/support/docview.wss?uid=swg1PM73445 (AIXAPAR)
  
• IBM Security Bulletin: Potential Security Vulnerabilities fixed in IBM WebSphere (CONFIRM)
  
• IBM X-Force Exchange Beta (XF)