Cross-site scripting in IBM WebSphere Application Server - CVE-2017-1380
Published: July 31, 2017
Vulnerability identifier: #VU7604
CSH Severity: Low
CVSS v4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]
CVE-ID: CVE-2017-1380
CWE-ID: CWE-79
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The disclosed vulnerability allows a remote attacker to perform cross-site scripting (XSS) attacks.
The vulnerability is caused by incorrect filtration of input data. A remote attacker can trick the victim to follow a specially crafted link and execute arbitrary HTML and script code in victim’s browser in security context of vulnerable website.
Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.
Affected software
IBM WebSphere Application Server
How to mitigate CVE-2017-1380
Update 7.0.x to version 7.0.0.45 or later.
Update 8.0.x to version 8.0.0.14 or later.
Update 8.5.x to version 8.5.5.12 or later.
Update 9.0.x to version 9.0.0.5 or later.
Update 8.0.x to version 8.0.0.14 or later.
Update 8.5.x to version 8.5.5.12 or later.
Update 9.0.x to version 9.0.0.5 or later.