IBM Security AppScan Enterprise CVE-2014-6135 Clickjacking Vulnerability

Bugtraq ID:	74322
Class:	Design Error
CVE:	CVE-2014-6135
Remote:	Yes
Local:	No
Published:	Apr 24 2015 12:00AM
Updated:	Apr 24 2015 12:00AM
Credit:	Paul Ionescu, Brennan Brazeau, John Zuccato, Jonathan Fitz-Gerald, Warren Moynihan
Vulnerable:	IBM Security AppScan Enterprise 9.0.1 IBM Security AppScan Enterprise 9.0 IBM Security AppScan Enterprise 8.8 IBM Security AppScan Enterprise 8.7 IBM Security AppScan Enterprise 8.6 IBM Security AppScan Enterprise 8.5
Not Vulnerable:

IBM Security AppScan Enterprise CVE-2014-6135 Clickjacking Vulnerability

IBM Security AppScan Enterprise is prone to a clickjacking vulnerability because it fails to perform validity checks on certain user actions through HTTP requests.

Successful exploits will allow an attacker to compromise the affected application or obtain sensitive information. Other attacks are also possible.

IBM Security AppScan Enterprise CVE-2014-6135 Clickjacking Vulnerability

An attacker can exploit this issue by enticing an unsuspecting user to visit a crafted webpage.

IBM Security AppScan Enterprise CVE-2014-6135 Clickjacking Vulnerability

Solution:
Updates are available. Please see the references or vendor advisory for more information.

IBM Security AppScan Enterprise CVE-2014-6135 Clickjacking Vulnerability

References:

• IBM Homepage (IBM)
  
• Security Bulletin: Multiple vulnerabilities in AppScan Enterprise (CVE-2014-6135 (IBM)