CVE-2014-0828: XSS

Published Apr 2, 2014

Updated

Cross-site scripting (XSS) vulnerability in the WCM (Web Content Manager) UI in IBM WebSphere Portal 6.1.0.x through 6.1.0.6 CF27, 6.1.5.x through 6.1.5.3 CF27, 7.0.0.x through 7.0.0.2 CF27, and 8.0.0.x before 8.0.0.1 CF11 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

Affected Software

16 affected components

IBM WebSphere Portal=6.1.0.0

IBM WebSphere Portal=6.1.0.1

IBM WebSphere Portal=6.1.0.2

IBM WebSphere Portal=6.1.0.3

IBM WebSphere Portal=6.1.0.4

IBM WebSphere Portal=6.1.0.5

IBM WebSphere Portal=6.1.0.6

IBM WebSphere Portal=6.1.5.0

IBM WebSphere Portal=6.1.5.1

IBM WebSphere Portal=6.1.5.2

IBM WebSphere Portal=6.1.5.3

IBM WebSphere Portal=7.0.0.0

IBM WebSphere Portal=7.0.0.1

IBM WebSphere Portal=7.0.0.2

IBM WebSphere Portal=8.0.0.0

IBM WebSphere Portal=8.0.0.1

Event History

Apr 2, 2014

CVE Published

via MITRE·01:00 AM

Data Sourced

via MITRE·01:00 AM

Description

Data Sourced

via NVD·03:58 AM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the severity of CVE-2014-0828?

CVE-2014-0828 has a medium severity rating due to its potential for cross-site scripting attacks.

How do I fix CVE-2014-0828?

To fix CVE-2014-0828, apply the latest patches or updates provided by IBM for affected versions of WebSphere Portal.

Which versions are affected by CVE-2014-0828?

CVE-2014-0828 affects IBM WebSphere Portal versions 6.1.0.x through 6.1.0.6 CF27, 6.1.5.x through 6.1.5.3 CF27, 7.0.0.x through 7.0.0.2 CF27, and 8.0.0.x before 8.0.0.1 CF11.

What type of vulnerability is CVE-2014-0828?

CVE-2014-0828 is classified as a cross-site scripting (XSS) vulnerability.

Can CVE-2014-0828 be exploited remotely?

Yes, CVE-2014-0828 allows remote attackers to inject arbitrary web scripts or HTML into the Web Content Manager UI.