Detections
Analytics
IBM WebSphere Portal 8.0.0.x < 8.0.0.1 CF15 / 8.5.0.0 < 8.5.0.0 CF05 Multiple XSRF / XSS (PI34987, PI33329, PI35228)
medium Nessus Plugin ID 82029
Language:
Synopsis
The remote Windows host has web portal software installed that is affected by multiple vulnerabilities.Description
The version of IBM WebSphere Portal installed on the remote host is 8.0.0.x prior to 8.0.0.1 Cumulative Fix 15 / 8.5.0.0 prior to 8.5.0.0 Cumulative Fix 05. It is, therefore, affected by multiple vulnerabilities :- An unspecified XSRF vulnerability exists due to improper validation of user-supplied input. A remote attacker can exploit this to perform authenticated actions, web cache poisoning, and other malicious activities.
(CVE-2014-6214 / PI34987)
- Multiple unspecified XSS vulnerabilities exist due to improper validation of user-supplied input. A remote attacker can exploit these issues to execute arbitrary script code in a user's browser. (CVE-2015-0139 / PI33329, CVE-2015-0177 / PI35228 )
Solution
Customers with IBM WebSphere Portal 8.0.0.x should upgrade to 8.0.0.1 CF15 and then apply Interim Fixes PI34987 and PI33329. Customers with IBM WebSphere Portal 8.5.0 should upgrade to 8.5.0 CF05 or later.See Also
Plugin Details
Severity: Medium
ID: 82029
File Name: websphere_portal_swg21697213.nasl
Version: 1.4
Type: local
Family: CGI abuses
Published: 3/24/2015
Updated: 1/19/2021
Supported Sensors: Nessus
Risk Information
VPR
Risk Factor: Medium
Score: 5.9
CVSS v2
Risk Factor: Medium
Base Score: 6.8
Temporal Score: 5.9
Vector: CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P
Vulnerability Information
CPE: cpe:/a:ibm:websphere_portal
Required KB Items: installed_sw/IBM WebSphere Portal
Exploit Ease: No exploit is required
Patch Publication Date: 3/5/2015
Vulnerability Publication Date: 3/5/2015