Cross-site scripting (XSS) vulnerability in the Administrative console in IBM WebSphere Application Server (WAS) 6.1 before 6.1.0.47, 7.0 before 7.0.0.29, 8.0 before 8.0.0.7, and 8.5 before 8.5.5.0 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

IBM WebSphere Application Server 6.1 before Fix Pack 47 appears to be running on the remote host.  As such, it is potentially affected by the following vulnerabilities :

  - A remote attacker can bypass authentication because of     improper user validation on Linux, Solaris, and HP-UX     platforms that use a LocalOS registry.
    (CVE-2013-0543, PM75582)

  - A denial of service can be caused by the way Apache     Ant uses bzip2 to compress files. This can be exploited     by a local attacker passing specially crafted input.
    (CVE-2012-2098, PM90088)

  - A local attacker can cause a denial of service on     Windows platforms with a LocalOS registry using     WebSphere Identity Manager. (CVE-2013-0541, PM74909)

  - Remote attackers can traverse directories by deploying     a specially crafted application file to overwrite files     outside of the application deployment directory.
    (CVE-2012-3305, PM62467)

  - The TLS protocol implementation is susceptible to     plaintext-recovery attacks via statistical analysis of     timing data for crafted packets. (CVE-2013-0169,     PM85211)

  - Terminal escape sequences are not properly filtered from     logs. Remote attackers could execute arbitrary commands     via an HTTP request containing an escape sequence.
    (CVE-2013-1862, PM87808)

  - Improper validation of user input allows for cross-site     request forgery. By persuading an authenticated user     to visit a malicious website, a remote attacker could     exploit this vulnerability to obtain sensitive     information. (CVE-2012-4853, CVE-2013-3029, PM62920,     PM88746)

  - Improper validation of user input in the administrative     console allows for multiple cross-site scripting     attacks. (CVE-2013-0458, CVE-2013-0459, CVE-2013-0461,     CVE-2013-0542, CVE-2013-0596, CVE-2013-2967,     CVE-2013-4005, CVE-2013-4052, PM71139, PM72536, PM71389,     PM73445, PM78614, PM81846, PM88208, PM91892)

  - Improper validation of portlets in the administrative     console allows for cross-site request forgery, which     could allow an attacker to obtain sensitive information.
    (CVE-2013-0460, PM72275)

  - Remote, authenticated attackers can traverse directories     on Linux and UNIX systems running the application.
    (CVE-2013-0544, PM82468)

  - A denial of service attack is possible if the optional     mod_dav module is being used. (CVE-2013-1896, PM89996)

  - Sensitive information can be obtained by a local     attacker because of incorrect caching by the     administrative console. (CVE-2013-2976, PM79992)

  - An attacker may gain elevated privileges because of     improper certificate checks. WS-Security and XML Digital     Signatures must be enabled. (CVE-2013-4053, PM90949,     PM91521)

  - Deserialization of a maliciously crafted OpenJPA object     can result in an executable file being written to the     file system. WebSphere is NOT vulnerable to this issue     but the vendor suggests upgrading to be proactive.
    (CVE-2013-1768, PM86780, PM86786, PM86788, PM86791)

IBM WebSphere Application Server 8.0 before Fix Pack 7 appears to be running on the remote host.  It is, therefore, potentially affected by the following vulnerabilities :

  - A flaw exists related to Apache Ant and file     compression that could lead to denial of service     conditions. (CVE-2012-2098 / PM90088)

  - The TLS protocol in the GSKIT component is vulnerable     to a plaintext recovery attack.
    (CVE-2013-0169 / PM85211)

  - A flaw exists relating to OAuth that could allow a     remote attacker to obtain someone else's credentials.
    (CVE-2013-0597 / PM85834 / PM87131)

  - A flaw exists relating to OpenJPA that is triggered     during deserialization, which could allow a remote     attacker to write to the file system and potentially     execute arbitrary code. Note the vendor states this     application is not directly affected by this flaw;
    however, this application does include the affected     version of OpenJPA. (CVE-2013-1768 / PM86780)

  - An input validation flaw exists in the optional     'mod_rewrite' module in the included IBM HTTP Server     that could allow arbitrary command execution via     HTTP requests containing certain escape sequences.
    (CVE-2013-1862 / PM87808)

  - A flaw exists related to the optional 'mod_dav'     module in the included IBM HTTP Server that could     allow denial of service conditions.
    (CVE-2013-1896 / PM89996)

  - User-supplied input validation errors exist related to     the administrative console that could allow cross-site     scripting attacks.
    (CVE-2013-2967 / PM78614, CVE-2013-4004 / PM81571,     CVE-2013-4005 / PM88208)

  - An information disclosure vulnerability exists related     to incorrect caching by the administrative console.
    (CVE-2013-2976 / PM79992)

  - A user-supplied input validation error exists that could     allow cross-site request forgery (CSRF) attacks to be     carried out. (CVE-2013-3029 / PM88746)

IBM WebSphere Application Server 8.5 before Fix Pack 8.5.5 appears to be running on the remote host and is, therefore, potentially affected by the following vulnerabilities :

  - The TLS protocol in the GSKIT component is vulnerable     to a plaintext recovery attack. (CVE-2013-0169, PM85211)

  - The WS-Security run time contains a flaw that could be     triggered by a specially crafted SOAP request to execute     arbitrary code. (CVE-2013-0482, PM76582)

  - A flaw exists relating to OAuth that could allow a     remote attacker to obtain someone else's credentials.
    (CVE-2013-0597, PM85834, PM87131)

  - A flaw exists relating to OpenJPA that is triggered     during deserialization, which could allow a remote     attacker to write to the file system and potentially     execute arbitrary code. (CVE-2013-1768, PM86780,     PM86786, PM86788, PM86791)

  - An unspecified cross-site scripting vulnerability exists     related to the administrative console. (CVE-2013-2967,     PM78614)

  - An unspecified vulnerability exists.  (CVE-2013-2975)

  - An information disclosure vulnerability exists relating     to incorrect caching by the administrative console.
    (CVE-2013-2976, PM79992)

  - An improper process initialization flaw exists on UNIX     platforms that could allow a local attacker to execute     arbitrary commands. (CVE-2013-3024, PM86245)

IBM WebSphere Application Server 7.0 before Fix Pack 29 appears to be running on the remote host.  It is, therefore, potentially affected by the following vulnerabilities :

  - The TLS protocol in the GSKIT component is vulnerable     to a plaintext recovery attack. (CVE-2013-0169, PM85211)

  - The WS-Security run time contains a flaw that could be     triggered by a specially crafted SOAP request to execute     arbitrary code. (CVE-2013-0482, PM76582)

  - A denial of service vulnerability exists, caused by a     buffer overflow on localOS registry when using WebSphere     Identity Manager (WIM). (CVE-2013-0541, PM74909)

  - An unspecified cross-site scripting vulnerability exists     related to the administrative console. (CVE-2013-0542,     CVE-2013-2967, PM78614, PM81846)

  - A validation flaw exists relating to 'Local OS     registries' that may allow a remote attacker to bypass     security. (CVE-2013-0543, PM75582)

  - A directory traversal vulnerability exists in the     administrative console via the 'PARAMETER' parameter.
    (CVE-2013-0544, PM82468)

  - A flaw exists relating to OAuth that could allow a     remote attacker to obtain someone else's credentials.
    (CVE-2013-0597, PM85834, PM87131)

  - A flaw exists relating to OpenJPA that is triggered     during deserialization that may allow a remote attacker     to write to the file system and potentially execute     arbitrary code. (CVE-2013-1768, PM86780, PM86786,     PM86788, PM86791)

  - An information disclosure issue exists relating to     incorrect caching by the administrative console.
    (CVE-2013-2976, PM79992)

  - A user-supplied input validation error exists that could     allow cross-site request (CSRF) attacks to be carried     out. (CVE-2013-3029, PM88746)

ID	Name	Product	Family	Severity
70022	IBM WebSphere Application Server 6.1 < Fix Pack 47 Multiple Vulnerabilities	Nessus	Web Servers	critical
69449	IBM WebSphere Application Server 8.0 < Fix Pack 7 Multiple Vulnerabilities	Nessus	Web Servers	high
69021	IBM WebSphere Application Server 8.5 < Fix Pack 8.5.5 Multiple Vulnerabilities	Nessus	Web Servers	high
68982	IBM WebSphere Application Server 7.0 < Fix Pack 29 Multiple Vulnerabilities	Nessus	Web Servers	high

Detections

Analytics

CVE-2013-2967

medium

Tenable Plugins

critical

high

high

high