Cross-site scripting (XSS) vulnerability in the virtual member manager (VMM) administrative console in IBM WebSphere Application Server (WAS) 6.1 before 6.1.0.47, 7.0 before 7.0.0.27, 8.0 before 8.0.0.6, and 8.5 before 8.5.0.2 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

IBM WebSphere Application Server 6.1 before Fix Pack 47 appears to be running on the remote host.  As such, it is potentially affected by the following vulnerabilities :

  - A remote attacker can bypass authentication because of     improper user validation on Linux, Solaris, and HP-UX     platforms that use a LocalOS registry.
    (CVE-2013-0543, PM75582)

  - A denial of service can be caused by the way Apache     Ant uses bzip2 to compress files. This can be exploited     by a local attacker passing specially crafted input.
    (CVE-2012-2098, PM90088)

  - A local attacker can cause a denial of service on     Windows platforms with a LocalOS registry using     WebSphere Identity Manager. (CVE-2013-0541, PM74909)

  - Remote attackers can traverse directories by deploying     a specially crafted application file to overwrite files     outside of the application deployment directory.
    (CVE-2012-3305, PM62467)

  - The TLS protocol implementation is susceptible to     plaintext-recovery attacks via statistical analysis of     timing data for crafted packets. (CVE-2013-0169,     PM85211)

  - Terminal escape sequences are not properly filtered from     logs. Remote attackers could execute arbitrary commands     via an HTTP request containing an escape sequence.
    (CVE-2013-1862, PM87808)

  - Improper validation of user input allows for cross-site     request forgery. By persuading an authenticated user     to visit a malicious website, a remote attacker could     exploit this vulnerability to obtain sensitive     information. (CVE-2012-4853, CVE-2013-3029, PM62920,     PM88746)

  - Improper validation of user input in the administrative     console allows for multiple cross-site scripting     attacks. (CVE-2013-0458, CVE-2013-0459, CVE-2013-0461,     CVE-2013-0542, CVE-2013-0596, CVE-2013-2967,     CVE-2013-4005, CVE-2013-4052, PM71139, PM72536, PM71389,     PM73445, PM78614, PM81846, PM88208, PM91892)

  - Improper validation of portlets in the administrative     console allows for cross-site request forgery, which     could allow an attacker to obtain sensitive information.
    (CVE-2013-0460, PM72275)

  - Remote, authenticated attackers can traverse directories     on Linux and UNIX systems running the application.
    (CVE-2013-0544, PM82468)

  - A denial of service attack is possible if the optional     mod_dav module is being used. (CVE-2013-1896, PM89996)

  - Sensitive information can be obtained by a local     attacker because of incorrect caching by the     administrative console. (CVE-2013-2976, PM79992)

  - An attacker may gain elevated privileges because of     improper certificate checks. WS-Security and XML Digital     Signatures must be enabled. (CVE-2013-4053, PM90949,     PM91521)

  - Deserialization of a maliciously crafted OpenJPA object     can result in an executable file being written to the     file system. WebSphere is NOT vulnerable to this issue     but the vendor suggests upgrading to be proactive.
    (CVE-2013-1768, PM86780, PM86786, PM86788, PM86791)

IBM WebSphere Application Server 8.5 before Fix Pack 2 appears to be running on the remote host and is, therefore, potentially affected by the following vulnerabilities :

  - The included Java SDK contains several errors that     affect the application directly. (CVE-2013-0169,     CVE-2013-0440, CVE-2013-0443)

  - Input validation errors exist related to the     administration console that could allow cross-site     scripting attacks. (CVE-2013-0458 / PM71139,     CVE-2013-0461 / PM71389, CVE-2013-0542 / PM81846,     CVE-2013-0565 / PM83402)

  - An input validation error exists related to the     administration console that could allow cross-site     scripting attacks. Note that this issue affects only     the application when running on z/OS operating systems.
    (CVE-2013-0459 / PM72536)

  - An unspecified error could allow security bypass for     authenticated users. (CVE-2013-0462 / PM76886 or     PM79937)

  - An error exists related to 'WS-Security' and SOAP     message handling that could allow an attacker to spoof     message signatures. (CVE-2013-0482 / PM76582)

  - An error exists related to authentication cookies that     could allow remote attackers to gain access to     restricted resources. Note this only affects the     application when running the 'Liberty Profile'.
    (CVE-2013-0540 / PM81056)

  - A buffer overflow error exists related to 'WebSphere     Identity Manger (WIM)' that could allow denial of     service attacks. (CVE-2013-0541 / PM74909)

  - An unspecified error could allow security bypass, thus     allowing remote attackers access to restricted resources     on HP, Linux and Solaris hosts.
    (CVE-2013-0543 / PM75582)

  - An unspecified error related to the administration     console could allow directory traversal attacks on     Unix and Linux hosts. (CVE-2013-0544 / PM82468)

IBM WebSphere Application Server 8.0 before Fix Pack 6 appears to be running on the remote host.  It is, therefore, potentially affected by the following vulnerabilities :

  - An input validation error exists that could allow     cross-site request forgery (CSRF) attacks.
    (CVE-2012-4853 / PM62920)

  - The included Java SDK contains several errors that     affect the application directly. (CVE-2013-0169,     CVE-2013-0440, CVE-2013-0443)

  - Input validation errors exist related to the     administration console that could allow cross-site     scripting attacks. (CVE-2013-0458 / PM71139,     CVE-2013-0461 / PM71389, CVE-2013-0542 / PM81846)

  - An input validation error exists related to the     administration console that could allow cross-site     scripting attacks. Note that this issue affects only     the application when running on z/OS operating systems.
    (CVE-2013-0459 / PM72536)

  - An unspecified error could allow security bypass for     authenticated users. (CVE-2013-0462 / PM76886 or     PM79937)

  - An error exists related to 'WS-Security' and SOAP     message handling that could allow an attacker to spoof     message signatures. (CVE-2013-0482 / PM76582)

  - A buffer overflow error exists related to 'WebSphere     Identity Manger (WIM)' that could allow denial of     service attacks. (CVE-2013-0541 / PM74909)

  - An unspecified error could allow security bypass, thus     allowing remote attackers access to restricted resources     on HP, Linux and Solaris hosts.
    (CVE-2013-0543 / PM75582)

  - An unspecified error related to the administration     console could allow directory traversal attacks on     Unix and Linux hosts. (CVE-2013-0544 / PM82468)

IBM WebSphere Application Server 7.0 before Fix Pack 27 appears to be running on the remote host.  It is, therefore, potentially affected by the following vulnerabilities :

  - A request validation error exists related to the proxy     server component that could allow a remote attacker to     cause the proxy status to be reported as disabled, thus     denying applications access to the proxy.
    (CVE-2012-3330, PM71319)

  - A user-supplied input validation error exists that could     allow cross-site request forgery (CSRF) attacks to be     carried out. (CVE-2012-4853, PM62920)

  - Unspecified errors exist related to the administration     console that could allow cross-site scripting attacks.
    (CVE-2013-0458, CVE-2013-0459, CVE-2013-0460, PM71139,     PM72536, PM72275)

  - An unspecified error exists related to the     administration console for 'virtual member manager'     (VMM) that can allow cross-site scripting.
    (CVE-2013-0461, PM71389)

ID	Name	Product	Family	Severity
70022	IBM WebSphere Application Server 6.1 < Fix Pack 47 Multiple Vulnerabilities	Nessus	Web Servers	critical
66375	IBM WebSphere Application Server 8.5 < Fix Pack 2 Multiple Vulnerabilities	Nessus	Web Servers	critical
66374	IBM WebSphere Application Server 8.0 < Fix Pack 6 Multiple Vulnerabilities	Nessus	Web Servers	critical
64097	IBM WebSphere Application Server 7.0 < Fix Pack 27 Multiple Vulnerabilities	Nessus	Web Servers	medium

Detections

Analytics

CVE-2013-0461

medium

Tenable Plugins

critical

critical

critical

medium