IBM WebSphere Service Registry and Repository (WSRR) 6.3.x before 6.3.0.5, 7.0.x through 7.0.0.5, 7.5.x before 7.5.0.3, and 8.0.x before 8.0.0.1 allows remote authenticated users to bypass intended object-access restrictions via the datagraph.

The version of IBM WebSphere Service Registry and Repository (WSRR) is version 8.0 prior to 8.0.0.3. It is therefore, affected by multiple vulnerabilities :

  - An unspecified DOM based cross-site scripting (XSS)     vulnerability in the WSRR web UI. (CVE-2014-6132)

  - WSSR web interface issues a cookie that is not declared     SSL only. (CVE-2014-6153)

  - An unspecified path traversal vulnerability in the     SERVICEREGISTRY UI. (CVE-2014-6155)

  - An unspecified script injection vulnerability in WSSR     widgets. (CVE-2014-6178)

  - An unspecified DOM based cross-site scripting (XSS)     vulnerability in the WSRR web UI. (CVE-2014-6179)

  - Improper enforcement of object access control     restrictions. (CVE-2014-6186)

  - An unspecified cross-site request forgery (XSRF)     vulnerability. (CVE-2014-6187)

  - Unspecified cross-site scripting (XSS) vulnerabilities.
    (CVE-2014-6188)

The version of IBM WebSphere Service Registry and Repository (WSRR) is version 7.5 prior to 7.5.0.4. It is therefore, affected by multiple vulnerabilities :

  - An unspecified DOM based cross-site scripting (XSS)     vulnerability in the WSRR web UI. (CVE-2014-6132)

  - WSSR web interface issues a cookie that is not declared     SSL only. (CVE-2014-6153)

  - An unspecified path traversal vulnerability in the     SERVICEREGISTRY UI. (CVE-2014-6155)

  - An unspecified information disclosure flaw related to     access control checks when a retrieve depth is 0.
    (CVE-2014-6177)

  - An unspecified script injection vulnerability in WSSR     widgets. (CVE-2014-6178)

  - An unspecified DOM based cross-site scripting (XSS)     vulnerability in the WSRR web UI. (CVE-2014-6179)

  - An unspecified HTML injection vulnerability related to     the User-Agent header in the WSRR web UI.
    (CVE-2014-6180)

  - Improper enforcement of object access control     restrictions. (CVE-2014-6186)

  - An unspecified cross-site request forgery (XSRF)     vulnerability. (CVE-2014-6187)

  - Unspecified cross-site scripting (XSS) vulnerabilities.
    (CVE-2014-6188)

The version of IBM WebSphere Service Registry and Repository (WSRR) is version 7.0 prior to 7.0.0.5. It is therefore, affected by multiple vulnerabilities :

  - An unspecified DOM based cross-site scripting (XSS)     vulnerability in the WSRR web UI. (CVE-2014-6132)

  - WSSR web interface issues a cookie that is not declared     SSL only. (CVE-2014-6153)

  - An unspecified information disclosure flaw related to     access control checks when a retrieve depth is 0.
    (CVE-2014-6177)

  - An unspecified HTML injection vulnerability related to     the User-Agent header in the WSRR web UI.
    (CVE-2014-6180)

  - An unspecified information disclosure flaw related to     the lack of access controls to contained objects.
    (CVE-2014-6181)

  - Improper enforcement of object access control     restrictions. (CVE-2014-6186)

  - An unspecified cross-site request forgery (XSRF)     vulnerability. (CVE-2014-6187)

  - Unspecified cross-site scripting (XSS) vulnerabilities.
    (CVE-2014-6188)

The version of IBM WebSphere Service Registry and Repository (WSRR) is version 6.3 prior to 6.3.0.5. It is therefore, affected by multiple vulnerabilities :

  - An unspecified DOM based cross-site scripting (XSS)     vulnerability in the WSRR web UI. (CVE-2014-6132)

  - WSSR web interface issues a cookie that is not declared     SSL only. (CVE-2014-6153)

  - Improper enforcement of object access control     restrictions. (CVE-2014-6186)

  - An unspecified cross-site request forgery (XSRF)     vulnerability. (CVE-2014-6187)

  - Unspecified cross-site scripting (XSS) vulnerabilities.
    (CVE-2014-6188)

ID	Name	Product	Family	Severity
80858	IBM WebSphere Service Registry and Repository 8.0 < 8.0.0.3 Multiple Vulnerabilities	Nessus	Windows	medium
80857	IBM WebSphere Service Registry and Repository 7.5 < 7.5.0.4 Multiple Vulnerabilities	Nessus	Windows	medium
80856	IBM WebSphere Service Registry and Repository 7.0 < 7.0.0.5 Multiple Vulnerabilities	Nessus	Windows	medium
80855	IBM WebSphere Service Registry and Repository 6.3 < 6.3.0.5 Multiple Vulnerabilities	Nessus	Windows	medium

Detections

Analytics

CVE-2014-6186

medium

Tenable Plugins

medium

medium

medium

medium