BID:74218

IBM WebSphere Portal and Web Content Manager CVE-2015-1908 Cross Site Scripting Vulnerability

Info

IBM WebSphere Portal and Web Content Manager CVE-2015-1908 Cross Site Scripting Vulnerability

Bugtraq ID:	74218
Class:	Input Validation Error
CVE:	CVE-2015-1908
Remote:	Yes
Local:	No
Published:	Apr 14 2015 12:00AM
Updated:	Apr 14 2015 12:00AM
Credit:	IBM
Vulnerable:	IBM Websphere Portal 8.5 CF03 IBM Websphere Portal 8.5 CF02 IBM Websphere Portal 8.5 IBM Websphere Portal 8.0 1 CF09 IBM Websphere Portal 8.0 IBM Websphere Portal 7.0 IBM Websphere Portal 6.1.5 .0 IBM Websphere Portal 6.1 .3 IBM Websphere Portal 6.1 .2 IBM Websphere Portal 6.1 .1 IBM Websphere Portal 8.0.0.1 CF14 IBM Websphere Portal 8.0.0.1 CF13 IBM Websphere Portal 8.0.0.1 CF12 IBM Websphere Portal 8.0.0.1 CF11 IBM Websphere Portal 8.0.0.1 CF09 IBM Websphere Portal 8.0.0.1 Cf08 IBM Websphere Portal 8.0.0.1 Cf07 IBM Websphere Portal 8.0.0.1 Cf06 IBM Websphere Portal 8.0.0.1 Cf05 IBM Websphere Portal 8.0.0.1 Cf04 IBM Websphere Portal 8.0.0.1 CF005 IBM Websphere Portal 8.0.0.1 IBM Websphere Portal 8.0.0.0 Cf05 IBM Websphere Portal 8.0.0.0 Cf04 IBM Websphere Portal 8.0.0.0 Cf03 IBM Websphere Portal 8.0.0.0 Cf02 IBM Websphere Portal 8.0.0.0 Cf01 IBM Websphere Portal 8.0.0 CF005 IBM Websphere Portal 7.0.0.2 CF28 IBM Websphere Portal 7.0.0.2 CF27 IBM Websphere Portal 7.0.0.2 Cf26 IBM Websphere Portal 7.0.0.2 Cf25 IBM Websphere Portal 7.0.0.2 Cf24 IBM Websphere Portal 7.0.0.2 Cf23 IBM Websphere Portal 7.0.0.2 CF026 IBM Websphere Portal 7.0.0.2 CF022 IBM Websphere Portal 7.0.0.2 Cf021 IBM Websphere Portal 7.0.0.2 Cf020 IBM Websphere Portal 7.0.0.2 Cf019 IBM Websphere Portal 7.0.0.2 Cf018 IBM Websphere Portal 7.0.0.2 Cf017 IBM Websphere Portal 7.0.0.2 Cf016 IBM Websphere Portal 7.0.0.2 Cf015 IBM Websphere Portal 7.0.0.2 Cf014 IBM Websphere Portal 7.0.0.2 Cf013 IBM Websphere Portal 7.0.0.2 Cf012 IBM Websphere Portal 7.0.0.2 Cf011 IBM Websphere Portal 7.0.0.2 IBM Websphere Portal 7.0.0.1 Cf019 IBM Websphere Portal 7.0.0.1 Cf010 IBM Websphere Portal 7.0.0.1 Cf009 IBM Websphere Portal 7.0.0.1 Cf008 IBM Websphere Portal 7.0.0.1 Cf007 IBM Websphere Portal 7.0.0.1 Cf006 IBM Websphere Portal 7.0.0.1 Cf005 IBM Websphere Portal 7.0.0.1 CF004 IBM Websphere Portal 7.0.0.1 CF003 IBM Websphere Portal 7.0.0.1 CF002 IBM Websphere Portal 7.0.0.1 - IBM Websphere Portal 7.0.0.1 IBM Websphere Portal 7.0.0.0 Cf001 IBM Websphere Portal 6.1.5.3 IBM Websphere Portal 6.1.5.2 IBM Websphere Portal 6.1.5.1 IBM Websphere Portal 6.1.0.6 IBM Websphere Portal 6.1.0.5 IBM Websphere Portal 6.1.0.4 IBM Websphere Portal 6.1.0.0 IBM Web Content Manager 0

Not Vulnerable:	IBM Websphere Portal 8.5 CF05 IBM Websphere Portal 8.0.0.1 CF16 IBM Websphere Portal 7.0.0.2 CF29 IBM Websphere Portal 6.1.5.3 CF27 IBM Websphere Portal 6.1.0.6 CF27

Discussion

IBM WebSphere Portal and Web Content Manager CVE-2015-1908 Cross Site Scripting Vulnerability

IBM WebSphere Portal and Web Content Manager are prone to an unspecified cross-site scripting vulnerability because it fails to sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and launch other attacks.

Solution / Fix

IBM WebSphere Portal and Web Content Manager CVE-2015-1908 Cross Site Scripting Vulnerability

Solution:
Updates are available. Please see the references or vendor advisory for more information.

References

IBM WebSphere Portal and Web Content Manager CVE-2015-1908 Cross Site Scripting Vulnerability

References: