Detections
Analytics
IBM WebSphere Portal 7.0.0.x < 7.0.0.2 CF28 Multiple Vulnerabilities
medium Nessus Plugin ID 74155
Language:
Synopsis
The remote Windows host has web portal software installed that is affected by multiple vulnerabilities.Description
The version of IBM WebSphere Portal installed on the remote host is affected by multiple vulnerabilities :- An unspecified denial of service vulnerability exists that allows a remote attacker to crash the host by sending a specially crafted web request. (CVE-2014-0949)
- A cross-site scripting (XSS) vulnerability exists in the 'FilterForm.jsp' script due to improper user input validation. An attacker can exploit the vulnerability to execute code in the security context of a user's browser to steal authentication cookies. (CVE-2014-0951)
- An unspecified open redirect vulnerability exists that allows an attacker to perform a phishing attack by enticing a user to click on a malicious URL.
(CVE-2014-0958)
Solution
IBM has published a cumulative fix (CF28) for WebSphere Portal 7.0.0.2. Refer to IBM's advisory for more information.See Also
http://www-01.ibm.com/support/docview.wss?uid=swg21672572
http://www.nessus.org/u?4e5ca5ae
Plugin Details
Severity: Medium
ID: 74155
File Name: websphere_portal_7_0_0_2_cf28.nasl
Version: 1.12
Type: local
Family: CGI abuses
Published: 5/23/2014
Updated: 1/19/2021
Supported Sensors: Nessus
Risk Information
VPR
Risk Factor: Medium
Score: 4.4
CVSS v2
Risk Factor: Medium
Base Score: 5.8
Temporal Score: 4.3
Vector: CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:N
Vulnerability Information
CPE: cpe:/a:ibm:websphere_portal
Required KB Items: installed_sw/IBM WebSphere Portal
Exploit Ease: No exploit is required
Patch Publication Date: 4/24/2014
Vulnerability Publication Date: 5/13/2014