The Web UI in IBM WebSphere Service Registry and Repository (WSRR) 6.3.x through 6.3.0.5, 7.0.x through 7.0.0.5, 7.5.x through 7.5.0.4, 8.0.x before 8.0.0.3, and 8.5.x before 8.5.0.1 does not set the secure flag for a cookie in an https session, which makes it easier for remote attackers to capture this cookie by intercepting its transmission within an http session.

The version of IBM WebSphere Service Registry and Repository (WSRR) is version 8.5 prior to 8.5.0.1. It is therefore, affected by multiple vulnerabilities :

  - An unspecified DOM based cross-site scripting (XSS)     vulnerability in the WSRR web UI. (CVE-2014-6132)

  - WSSR web interface issues a cookie that is not declared     SSL only. (CVE-2014-6153)

  - An unspecified path traversal vulnerability in the     SERVICEREGISTRY UI. (CVE-2014-6155)

  - A session persistence flaw in which users remain logged     into SERVICEREGISTRYDASHBOARD when using WebSEAL or     Chrome. (CVE-2014-6160)

The version of IBM WebSphere Service Registry and Repository (WSRR) is version 8.0 prior to 8.0.0.3. It is therefore, affected by multiple vulnerabilities :

  - An unspecified DOM based cross-site scripting (XSS)     vulnerability in the WSRR web UI. (CVE-2014-6132)

  - WSSR web interface issues a cookie that is not declared     SSL only. (CVE-2014-6153)

  - An unspecified path traversal vulnerability in the     SERVICEREGISTRY UI. (CVE-2014-6155)

  - An unspecified script injection vulnerability in WSSR     widgets. (CVE-2014-6178)

  - An unspecified DOM based cross-site scripting (XSS)     vulnerability in the WSRR web UI. (CVE-2014-6179)

  - Improper enforcement of object access control     restrictions. (CVE-2014-6186)

  - An unspecified cross-site request forgery (XSRF)     vulnerability. (CVE-2014-6187)

  - Unspecified cross-site scripting (XSS) vulnerabilities.
    (CVE-2014-6188)

The version of IBM WebSphere Service Registry and Repository (WSRR) is version 7.5 prior to 7.5.0.4. It is therefore, affected by multiple vulnerabilities :

  - An unspecified DOM based cross-site scripting (XSS)     vulnerability in the WSRR web UI. (CVE-2014-6132)

  - WSSR web interface issues a cookie that is not declared     SSL only. (CVE-2014-6153)

  - An unspecified path traversal vulnerability in the     SERVICEREGISTRY UI. (CVE-2014-6155)

  - An unspecified information disclosure flaw related to     access control checks when a retrieve depth is 0.
    (CVE-2014-6177)

  - An unspecified script injection vulnerability in WSSR     widgets. (CVE-2014-6178)

  - An unspecified DOM based cross-site scripting (XSS)     vulnerability in the WSRR web UI. (CVE-2014-6179)

  - An unspecified HTML injection vulnerability related to     the User-Agent header in the WSRR web UI.
    (CVE-2014-6180)

  - Improper enforcement of object access control     restrictions. (CVE-2014-6186)

  - An unspecified cross-site request forgery (XSRF)     vulnerability. (CVE-2014-6187)

  - Unspecified cross-site scripting (XSS) vulnerabilities.
    (CVE-2014-6188)

The version of IBM WebSphere Service Registry and Repository (WSRR) is version 7.0 prior to 7.0.0.5. It is therefore, affected by multiple vulnerabilities :

  - An unspecified DOM based cross-site scripting (XSS)     vulnerability in the WSRR web UI. (CVE-2014-6132)

  - WSSR web interface issues a cookie that is not declared     SSL only. (CVE-2014-6153)

  - An unspecified information disclosure flaw related to     access control checks when a retrieve depth is 0.
    (CVE-2014-6177)

  - An unspecified HTML injection vulnerability related to     the User-Agent header in the WSRR web UI.
    (CVE-2014-6180)

  - An unspecified information disclosure flaw related to     the lack of access controls to contained objects.
    (CVE-2014-6181)

  - Improper enforcement of object access control     restrictions. (CVE-2014-6186)

  - An unspecified cross-site request forgery (XSRF)     vulnerability. (CVE-2014-6187)

  - Unspecified cross-site scripting (XSS) vulnerabilities.
    (CVE-2014-6188)

The version of IBM WebSphere Service Registry and Repository (WSRR) is version 6.3 prior to 6.3.0.5. It is therefore, affected by multiple vulnerabilities :

  - An unspecified DOM based cross-site scripting (XSS)     vulnerability in the WSRR web UI. (CVE-2014-6132)

  - WSSR web interface issues a cookie that is not declared     SSL only. (CVE-2014-6153)

  - Improper enforcement of object access control     restrictions. (CVE-2014-6186)

  - An unspecified cross-site request forgery (XSRF)     vulnerability. (CVE-2014-6187)

  - Unspecified cross-site scripting (XSS) vulnerabilities.
    (CVE-2014-6188)

ID	Name	Product	Family	Severity
80859	IBM WebSphere Service Registry and Repository 8.5 < 8.5.0.1 Multiple Vulnerabilities	Nessus	Windows	medium
80858	IBM WebSphere Service Registry and Repository 8.0 < 8.0.0.3 Multiple Vulnerabilities	Nessus	Windows	medium
80857	IBM WebSphere Service Registry and Repository 7.5 < 7.5.0.4 Multiple Vulnerabilities	Nessus	Windows	medium
80856	IBM WebSphere Service Registry and Repository 7.0 < 7.0.0.5 Multiple Vulnerabilities	Nessus	Windows	medium
80855	IBM WebSphere Service Registry and Repository 6.3 < 6.3.0.5 Multiple Vulnerabilities	Nessus	Windows	medium

Detections

Analytics

CVE-2014-6153

low

Tenable Plugins

medium

medium

medium

medium

medium