4.3
CVE-2013-0499
- EPSS 1.21%
- Veröffentlicht 28.05.2013 16:55:01
- Zuletzt bearbeitet 29.04.2026 01:13:23
- Erkennungen
LoginCross-site scripting (XSS) vulnerability in the echo functionality on IBM WebSphere DataPower SOA appliances with firmware 3.8.2, 4.0, 4.0.1, 4.0.2, and 5.0.0 allows remote attackers to inject arbitrary web script or HTML via a SOAP message, as demonstrated by the XML Firewall, Multi Protocol Gateway (MPGW), Web Service Proxy, and Web Token services.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Ibm ≫ Websphere Datapower Xc10 Appliance Firmware Version 3.8.2
Ibm ≫ Websphere Datapower Xc10 Appliance Firmware Version 4.0
Ibm ≫ Websphere Datapower Xc10 Appliance Firmware Version 4.0.1
Ibm ≫ Websphere Datapower Xc10 Appliance Firmware Version 4.0.2
Ibm ≫ Websphere Datapower Xc10 Appliance Firmware Version 5.0.0
Ibm ≫ Websphere Datapower Xc10 Appliance Version -
Ibm ≫ Websphere Datapower Service Gateway Xg45 Virtual Edition Firmware Version 3.8.2
Ibm ≫ Websphere Datapower Service Gateway Xg45 Virtual Edition Firmware Version 4.0.1
Ibm ≫ Websphere Datapower Service Gateway Xg45 Virtual Edition Firmware Version 4.0.2
Ibm ≫ Websphere Datapower Service Gateway Xg45 Virtual Edition Firmware Version 5.0.0
Ibm ≫ Websphere Datapower Service Gateway Xg45 Firmware Version 3.8.2
Ibm ≫ Websphere Datapower Service Gateway Xg45 Firmware Version 4.0
Ibm ≫ Websphere Datapower Service Gateway Xg45 Firmware Version 4.0.1
Ibm ≫ Websphere Datapower Service Gateway Xg45 Firmware Version 4.0.2
Ibm ≫ Websphere Datapower Service Gateway Xg45 Firmware Version 5.0.0
Ibm ≫ Websphere Datapower Service Gateway Xg45 Version -
Ibm ≫ Websphere Datapower Integration Appliance Xi52 Firmware Version 3.8.2
Ibm ≫ Websphere Datapower Integration Appliance Xi52 Firmware Version 4.0
Ibm ≫ Websphere Datapower Integration Appliance Xi52 Firmware Version 4.0.1
Ibm ≫ Websphere Datapower Integration Appliance Xi52 Firmware Version 4.0.2
Ibm ≫ Websphere Datapower Integration Appliance Xi52 Firmware Version 5.0.0
Ibm ≫ Websphere Datapower Integration Appliance Xi52 Version -
Ibm ≫ Websphere Datapower Integration Appliance Xi50 Firmware Version 3.8.2
Ibm ≫ Websphere Datapower Integration Appliance Xi50 Firmware Version 4.0
Ibm ≫ Websphere Datapower Integration Appliance Xi50 Firmware Version 4.0.1
Ibm ≫ Websphere Datapower Integration Appliance Xi50 Firmware Version 4.0.2
Ibm ≫ Websphere Datapower Integration Appliance Xi50 Firmware Version 5.0.0
Ibm ≫ Websphere Datapower Integration Appliance Xi50 Version -
Ibm ≫ Websphere Datapower B2b Appliance Xb62 Firmware Version 3.8.2
Ibm ≫ Websphere Datapower B2b Appliance Xb62 Firmware Version 4.0
Ibm ≫ Websphere Datapower B2b Appliance Xb62 Firmware Version 4.0.1
Ibm ≫ Websphere Datapower B2b Appliance Xb62 Firmware Version 4.0.2
Ibm ≫ Websphere Datapower B2b Appliance Xb62 Firmware Version 5.0.0
Ibm ≫ Websphere Datapower B2b Appliance Xb62 Version -
| Typ | Quelle | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 1.21% | 0.644 |
| Quelle | Base Score | Exploit Score | Impact Score | Vector String |
|---|---|---|---|---|
| NIST | 4.3 | 8.6 | 2.9 |
AV:N/AC:M/Au:N/C:N/I:P/A:N
|
CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
http://seclists.org/bugtraq/2013/May/83
http://www-01.ibm.com/support/docview.wss?uid=swg21637717
https://exchange.xforce.ibmcloud.com/vulnerabilities/82221
https://www.sec-consult.com/fxdata/seccons/prod/temedia/advisories_txt/20130523-0_IBM_Xi50_Echo-WebService_Xss_in_Xml_v10.txt