Cross-site scripting in IBM WebSphere Application Server Liberty - CVE-2024-27270

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU87831

Cross-site scripting in IBM WebSphere Application Server Liberty - CVE-2024-27270

Published: March 26, 2024


Vulnerability identifier: #VU87831
CSH Severity: Medium
CVSS v4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]
CVE-ID: CVE-2024-27270
CWE-ID: CWE-79
Exploitation vector: Remote access
Exploit availability: No public exploit available

Vulnerability details

The disclosed vulnerability allows a remote attacker to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to insufficient sanitization of user-supplied data. A remote attacker can trick the victim to follow a specially crafted link and execute arbitrary HTML and script code in user's browser in context of vulnerable website.

Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.


Affected software

IBM WebSphere Application Server Liberty
IBM SPSS Analytic Server
IBM Sterling B2B Integrator
IBM Tivoli Netcool Impact
IBM Spectrum Symphony
CICS Transaction Gateway
IBM Process Mining
IBM Cloud Transformation Advisor
IBM Watson Discovery for IBM Cloud Pak for Data
IBM Match 360
IBM Spectrum Control
IBM Cloud Application Performance Management (APM)
IBM SPSS Collaboration and Deployment Services
IBM Maximo Application Suite
IBM TXSeries for Multiplatforms
IBM Business Automation Workflow
IBM Cloud Pak for Business Automation
IBM i
IBM Tivoli Application Dependency Discovery Manager
IBM Cognos Controller
Financial Transaction Manager
PowerVM NovaLink
IBM Planning Analytics Workspace
Storage Protect Operations Center
Maximo Application Suite - Monitor Component
Maximo Application Suite - Predict Component
Robotic Process Automation for Cloud Pak
Business Automation Insights
Planning Analytics Local
IBM Cognos Analytics
IBM Cloud Pak System
IBM CICS TX Advanced
IBM CICS TX Standard
IBM InfoSphere Information Server

How to mitigate CVE-2024-27270

Install updates from vendor's website.

IBM Sterling B2B Integrator - addressed in versions 6.1.2.6, 6.2.0.3
IBM Tivoli Netcool Impact - update to 7.1.0.34
IBM Spectrum Symphony - update to 7.3.2 FP3
IBM Cognos Controller - update to 11.0.1.0.3
IBM Process Mining - update to 1.15.0 IF004
PowerVM NovaLink - addressed in versions 2.0.3.1-240625, 2.1.1-240625, 2.2.1-240626
Planning Analytics Local - update to 2.0.9.20
IBM Planning Analytics Workspace - update to 2.1.4
IBM Cloud Pak System - update to 2.3.4.1
IBM Cloud Transformation Advisor - update to 3.10.0
Financial Transaction Manager - update to 4.0.6.0 iFix4
IBM Watson Discovery for IBM Cloud Pak for Data - update to 4.8.6
IBM Match 360 - update to 5.0.1
IBM Spectrum Control - update to 5.4.12
IBM Cloud Application Performance Management (APM) - update to 8.1.4.0.17
Storage Protect Operations Center - update to 8.1.23
IBM SPSS Collaboration and Deployment Services - update to 8.5.0.0.14
Maximo Application Suite - Monitor Component - addressed in versions 8.10.12, 8.11.9, 9.0.0
IBM Maximo Application Suite - addressed in versions 8.10.14, 8.11.11, 9.0.0
Maximo Application Suite - Predict Component - update to 9.0.0
IBM TXSeries for Multiplatforms - update to 9.1.0.3
IBM CICS TX Advanced - addressed in versions 10.1.0.0 ifix26, 11.1.0.0 ifix19
IBM CICS TX Standard - update to 11.1.0.0 ifix19
IBM Cognos Analytics - addressed in versions 11.2.4 FP4, 12.0.4
IBM InfoSphere Information Server - update to 11.7.1 Fix Pack 5
IBM Business Automation Workflow - addressed in versions 21.0.3 IF033, 23.0.2 IF005
IBM Cloud Pak for Business Automation - addressed in versions 21.0.3.32, 23.0.2.4
Robotic Process Automation for Cloud Pak - addressed in versions 21.0.7.15, 23.0.16
Business Automation Insights - update to 23.0.2.0.6

External References

Related Security Bulletins