IBM Watson Cross Site Scripting and Open Redirection Vulnerabilities
BID:75053
Info
IBM Watson Cross Site Scripting and Open Redirection Vulnerabilities
| Bugtraq ID: | 75053 |
| Class: | Input Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Jun 05 2015 12:00AM |
| Updated: | Jun 05 2015 12:00AM |
| Credit: | Jerold Hoong |
| Vulnerable: |
IBM Watson 0 |
| Not Vulnerable: | |
Discussion
IBM Watson Cross Site Scripting and Open Redirection Vulnerabilities
IBM Watson is prone to a cross-site scripting vulnerability and an open-redirection vulnerability.
An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site, this may allow the attacker to steal cookie-based authentication credentials and to launch other attacks or by constructing a crafted URI and enticing a user to follow it and when an unsuspecting victim follows the link, they may be redirected to an attacker-controlled site.
IBM Watson is prone to a cross-site scripting vulnerability and an open-redirection vulnerability.
An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site, this may allow the attacker to steal cookie-based authentication credentials and to launch other attacks or by constructing a crafted URI and enticing a user to follow it and when an unsuspecting victim follows the link, they may be redirected to an attacker-controlled site.
Exploit / POC
IBM Watson Cross Site Scripting and Open Redirection Vulnerabilities
To exploit these issues, an attacker must entice an unsuspecting victim to follow a malicious URI.
To exploit these issues, an attacker must entice an unsuspecting victim to follow a malicious URI.
Solution / Fix
IBM Watson Cross Site Scripting and Open Redirection Vulnerabilities
Solution:
Reportedly, the issue is fixed; however, Symantec has not confirmed this. Please contact the vendor for more information.
Solution:
Reportedly, the issue is fixed; however, Symantec has not confirmed this. Please contact the vendor for more information.
References
IBM Watson Cross Site Scripting and Open Redirection Vulnerabilities
References:
References:
- IBM Homepage (IBM)
- Watson Product Page (IBM)