IBM Content Navigator CVE-2017-1282 Cross Site Scripting Vulnerability

Bugtraq ID:	98563
Class:	Input Validation Error
CVE:	CVE-2017-1282
Remote:	Yes
Local:	No
Published:	May 08 2017 12:00AM
Updated:	May 08 2017 12:00AM
Credit:	The vendor reported this issue.
Vulnerable:	IBM Content Navigator 3.0 IBM Content Navigator 2.0.3.8 IBM Content Navigator 2.0.3.7 IBM Content Navigator 2.0.3.6 IBM Content Navigator 2.0.3.5
Not Vulnerable:

IBM Content Navigator CVE-2017-1282 Cross Site Scripting Vulnerability

IBM Content Navigator is prone to a cross-site scripting vulnerability.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

The following versions are vulnerable:

IBM Content Navigator versions 2.0.3.5 through 2.0.3.8
IBM Content Navigator version 3.0.0

IBM Content Navigator CVE-2017-1282 Cross Site Scripting Vulnerability

To exploit this issue an attacker must entice an unsuspecting victim to follow a malicious URI.

IBM Content Navigator CVE-2017-1282 Cross Site Scripting Vulnerability

Solution:
Updates are available. Please see the references or vendor advisory for more information.

IBM Content Navigator CVE-2017-1282 Cross Site Scripting Vulnerability

References:

• IBM Content Navigator overview (IBM)
  
• IBM Homepage (IBM)
  
• swg22002356: IBM Content Navigator Cross Site Scripting Vulnerability (IBM)