Cross-site scripting in Financial Transaction Manager - CVE-2016-0253

Detailed vulnerability description

Vulnerability allows a remote attacker to perform XSS attacks.

The vulnerability is caused by an input validation error in IBM Financial Transaction Manager (FTM) for ACH Services for Multi-Platform 2.1.1.2 and 3.0.0.x before fp0013, Financial Transaction Manager (FTM) for Check Services for Multi-Platform 2.1.1.2 and 3.0.0.x before fp0013, and Financial Transaction Manager (FTM) for Corporate Payment Services (CPS) for Multi-Platform 2.1.1.2 and 3.0.0.x before fp0013. A remote attacker can trick the victim to follow a specially crafted link and execute arbitrary HTML and script code in victim's browser in security context of vulnerable website.

Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.

How to mitigate CVE-2016-0253

Sources

• http://www-01.ibm.com/support/docview.wss?uid=swg21977245
• https://exchange.xforce.ibmcloud.com/vulnerabilities/110562