Cross-site scripting (XSS) vulnerability in IBM WebSphere Application Server 7.0 before 7.0.0.41, 8.0 before 8.0.0.12, and 8.5 before 8.5.5.9 allows remote authenticated users to inject arbitrary web script or HTML via crafted data from an OAuth provider.

The remote host appears to be running IBM WebSphere Application Server 8.5 prior to 8.5.5.9.  Such versions are potentially affected by multiple issues :

 - A flaw exists allowing a reflected cross-site scripting (XSS) vulnerability due to a failure to properly validate output from the OAuth provider before returning it to users.  An authenticated, remote attacker can exploit this, via a specially crafted URL, to execute arbitrary script code in a user's browser session within the security context of the hosting website. (CVE-2015-7417)
 - A flaw exists that allows an XSS attack.  This flaw exists because the OpenID Connect (OIDC) client does not validate input before returning it to users.  This may allow a remote attacker to create a specially crafted request that would execute arbitrary script code in a user's browser session within the trust relationship between their browser and the server. (CVE-2016-0283)

The remote host appears to be running IBM WebSphere Application Server 8.0 prior to 8.0.0.12.  Such versions are potentially affected by multiple issues :

 - A flaw exists that is triggered as CRLF (Carriage Return and Line Feed) character sequences are not properly sanitized before being included in HTTP responses.  This allows a remote attacker to inject additional headers into responses to conduct HTTP response splitting attacks.
 - An unspecified flaw exists in the edge component caching proxy that could cause weaker than intended encryption, which may potentially allow an authenticated remote attacker to more easily decrypt information.
 - A flaw exists allowing a reflected cross-site scripting (XSS) vulnerability due to a failure to properly validate output from the OAuth provider before returning it to users.  An authenticated, remote attacker can exploit this, via a specially crafted URL, to execute arbitrary script code in a user's browser session within the security context of the hosting website.
 - A flaw exists that is triggered when handling a connect call that is interrupted.  This may allow a remote attacker to crash the plug-in component and cause a partial denial of service.
 - An overflow condition exists that is triggered as certain input is not properly validated.  This may allow an authenticated remote attacker to cause a buffer overflow, potentially allowing them to bypass security restrictions and disclose sensitive information.

The remote host appears to be running IBM WebSphere Application Server 7.0 prior to 7.0.0.41.  Such versions are potentially affected by multiple issues :

 - A flaw exists allowing a reflected cross-site scripting (XSS) vulnerability due to a failure to properly validate output from the OAuth provider before returning it to users.  An authenticated, remote attacker can exploit this, via a specially crafted URL, to execute arbitrary script code in a user's browser session within the security context of the hosting website. (CVE-2015-7417)
 - A flaw exists in the FIPS140-2 implementation that is related to an improper TLS configuration.  This may allow an attacker with the ability to intercept network traffic (e.g. MitM, DNS cache poisoning) to disclose transmitted data. (CVE-2016-0306)
 - A flaw exists that is due to the program improperly setting the CSRFtoken cookie.  This may allow an authenticated remote attacker to gain access to potentially sensitive information. (CVE-2016-0377)
 - An overflow condition exists that is triggered as certain input is not properly validated.  This may allow an authenticated remote attacker to cause a buffer overflow, potentially allowing them to bypass security restrictions and disclose sensitive information. (CVE-2016-0385)

The IBM WebSphere Application Server running on the remote host is version 7.0 prior to 7.0.0.41, 8.0 prior to 8.0.0.12, or 8.5 prior to 8.5.5.9. It is, therefore, potentially affected by a reflected cross-site scripting (XSS) vulnerability due to a failure to properly validate output from the OAuth provider before returning it to users.
An authenticated, remote attacker can exploit this, via a specially crafted URL, to execute arbitrary script code in a user's browser session within the security context of the hosting website.

ID	Name	Product	Family	Severity
9719	IBM WebSphere Application Server 8.5 < 8.5.5.9 Multiple Vulnerabilities	Nessus Network Monitor	Web Servers	medium
9714	IBM WebSphere Application Server 8.0 < 8.0.0.12 Multiple Vulnerabilities	Nessus Network Monitor	Web Servers	low
9701	IBM WebSphere Application Server 7.0 < 7.0.0.41 Multiple Vulnerabilities	Nessus Network Monitor	Web Servers	low
90316	IBM WebSphere Application Server 7.0 < 7.0.0.41 / 8.0 < 8.0.0.12 / 8.5 < 8.5.5.9 OAuth Provider XSS	Nessus	Web Servers	medium

Detections

Analytics

CVE-2015-7417

medium

Tenable Plugins

medium

low

low

medium