OSVDB ID: 25369 Title: IBM WebSphere Application Server (WAS) URL Unspecified Script Execution (PK15571) |
Info |
|
|
Dates |
||||
|
|
Description |
WebSphere Application Server contains a flaw that allows a remote script execution attack. This flaw exists because the software does not validate all script tags passed as part of an URL. This could allow a user to create a specially crafted URL that would execute scripting code in a user's browser within the trust relationship between the browser and the server, leading to a loss of integrity. |
Classification |
Location:
Remote / Network Access
Attack Type: Input Manipulation Impact: Loss of Integrity Exploit: Exploit Unknown Disclosure: OSVDB Verified, Vendor Verified OSVDB: Web Related |
Solution |
Upgrade to version 6.0.2 Fix Pack 5 or higher, version 5.1.1 Cumulative Fix 10 or higher, or 5.0.2 Cumulative Fix 16 or higher, respectively, as it has been reported to fix this vulnerability. An upgrade is required as there are no known workarounds. |
Products |
|
References |
|
Credit |
Unknown or Incomplete |