6.1

CVE-2017-1189

IBM WebSphere Portal and Web Content Manager 6.1, 7.0, and 8.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 123558.

Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Ibm ≫ Websphere Portal Version6.1.0.0
Ibm ≫ Websphere Portal Version6.1.0.1
Ibm ≫ Websphere Portal Version6.1.0.2
Ibm ≫ Websphere Portal Version6.1.0.3
Ibm ≫ Websphere Portal Version6.1.0.4
Ibm ≫ Websphere Portal Version6.1.0.5
Ibm ≫ Websphere Portal Version6.1.0.6
Ibm ≫ Websphere Portal Version6.1.5.0
Ibm ≫ Websphere Portal Version6.1.5.1
Ibm ≫ Websphere Portal Version6.1.5.2
Ibm ≫ Websphere Portal Version6.1.5.3
Ibm ≫ Websphere Portal Version7.0.0.0
Ibm ≫ Websphere Portal Version7.0.0.0 Updatecf001
Ibm ≫ Websphere Portal Version7.0.0.1
Ibm ≫ Websphere Portal Version7.0.0.1 Updatecf002
Ibm ≫ Websphere Portal Version7.0.0.1 Updatecf003
Ibm ≫ Websphere Portal Version7.0.0.1 Updatecf004
Ibm ≫ Websphere Portal Version7.0.0.1 Updatecf005
Ibm ≫ Websphere Portal Version7.0.0.1 Updatecf006
Ibm ≫ Websphere Portal Version7.0.0.1 Updatecf007
Ibm ≫ Websphere Portal Version7.0.0.1 Updatecf008
Ibm ≫ Websphere Portal Version7.0.0.1 Updatecf009
Ibm ≫ Websphere Portal Version7.0.0.1 Updatecf010
Ibm ≫ Websphere Portal Version7.0.0.1 Updatecf019
Ibm ≫ Websphere Portal Version7.0.0.2
Ibm ≫ Websphere Portal Version7.0.0.2 Updatecf011
Ibm ≫ Websphere Portal Version7.0.0.2 Updatecf012
Ibm ≫ Websphere Portal Version7.0.0.2 Updatecf013
Ibm ≫ Websphere Portal Version7.0.0.2 Updatecf014
Ibm ≫ Websphere Portal Version7.0.0.2 Updatecf015
Ibm ≫ Websphere Portal Version7.0.0.2 Updatecf016
Ibm ≫ Websphere Portal Version7.0.0.2 Updatecf017
Ibm ≫ Websphere Portal Version7.0.0.2 Updatecf018
Ibm ≫ Websphere Portal Version7.0.0.2 Updatecf019
Ibm ≫ Websphere Portal Version7.0.0.2 Updatecf020
Ibm ≫ Websphere Portal Version7.0.0.2 Updatecf021
Ibm ≫ Websphere Portal Version7.0.0.2 Updatecf022
Ibm ≫ Websphere Portal Version7.0.0.2 Updatecf23
Ibm ≫ Websphere Portal Version7.0.0.2 Updatecf24
Ibm ≫ Websphere Portal Version7.0.0.2 Updatecf25
Ibm ≫ Websphere Portal Version7.0.0.2 Updatecf26
Ibm ≫ Websphere Portal Version7.0.0.2 Updatecf27
Ibm ≫ Websphere Portal Version8.0
Ibm ≫ Websphere Portal Version8.0.0.0
Ibm ≫ Websphere Portal Version8.0.0.0 Updatecf01
Ibm ≫ Websphere Portal Version8.0.0.0 Updatecf02
Ibm ≫ Websphere Portal Version8.0.0.0 Updatecf03
Ibm ≫ Websphere Portal Version8.0.0.0 Updatecf04
Ibm ≫ Websphere Portal Version8.0.0.0 Updatecf05
Ibm ≫ Websphere Portal Version8.0.0.1
Ibm ≫ Websphere Portal Version8.0.0.1 Updatecf04
Ibm ≫ Websphere Portal Version8.0.0.1 Updatecf05
Ibm ≫ Websphere Portal Version8.0.0.1 Updatecf06
Ibm ≫ Websphere Portal Version8.0.0.1 Updatecf07
Ibm ≫ Websphere Portal Version8.0.0.1 Updatecf08
Ibm ≫ Websphere Portal Version8.0.0.1 Updatecf09
Ibm ≫ Websphere Portal Version8.0.0.1 Updatecf12
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.31% 0.51
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 6.1 2.8 2.7
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
nvd@nist.gov 4.3 8.6 2.9
AV:N/AC:M/Au:N/C:N/I:P/A:N
CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

http://www.securityfocus.com/bid/100699
Third Party Advisory
VDB Entry
http://www.securitytracker.com/id/1039268
Third Party Advisory
VDB Entry