Detections
Analytics
IBM Rational RequisitePro ReqWebHelp Multiple XSS
medium Nessus Plugin ID 42191
Language:
Synopsis
The remote web server hosts two JSP scripts that are affected by cross-site scripting vulnerabilities.Description
IBM Rational RequisitePro is installed on the remote host.The installed version contains two JSP scripts that are affected by cross-site scripting vulnerabilities. Specifically, it fails to sanitize input to the 'searchWord', 'maxHits', 'scopedSearch', and 'scope' parameters of 'searchView.jsp' and the 'operation' parameter of 'workingSet.jsp' before using it to generate dynamic HTML content. An unauthenticated, remote attacker may be able to leverage these issues to inject arbitrary HTML or script code into a user's browser to be executed within the security context of the affected site.
Solution
Please contact the vendor for a solution as a new help engine is reportedly available to address these issues.See Also
Plugin Details
Severity: Medium
ID: 42191
File Name: ibm_rational_requisitepro_multiple_xss.nasl
Version: 1.18
Type: remote
Family: CGI abuses : XSS
Published: 10/20/2009
Updated: 4/11/2022
Configuration: Enable thorough checks
Supported Sensors: Nessus
Risk Information
VPR
Risk Factor: Medium
Score: 6.2
CVSS v2
Risk Factor: Medium
Base Score: 4.3
Temporal Score: 3.7
Vector: CVSS2#AV:N/AC:M/Au:N/C:N/I:P/A:N
Vulnerability Information
CPE: cpe:/a:ibm:rational_requisitepro
Exploit Ease: No exploit is required
Exploited by Nessus: true
Patch Publication Date: 10/15/2009
Vulnerability Publication Date: 10/15/2009
Reference Information
CVE: CVE-2009-3730
BID: 36721