CVE-2014-0883: IBM Power Hardware Management Console cross-site scripting
Cross-site scripting (XSS) vulnerability in IBM Power Hardware Management Console (HMC) 7R7.1.0, 7R7.2.0, 7R7.3.0 through 7R7.3.5, 7R7.7.0 through SP3, and 7R7.8.0 before SP1 allows remote attackers to inject arbitrary web script or HTML via the user name on the logon screen. IBM X-Force ID: 91163.
Other sources
IBM Power HMC 7.1.0 through 7.8.0 and 7.3.5 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 91163.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2014-0883?
CVE-2014-0883 has a medium severity rating due to its cross-site scripting vulnerability.
How do I fix CVE-2014-0883?
To fix CVE-2014-0883, update to a patched version of the IBM Power Hardware Management Console firmware.
What versions are affected by CVE-2014-0883?
CVE-2014-0883 affects IBM Power Hardware Management Console versions 7R7.1.0 through 7R7.3.5 and 7R7.7.0 up to SP3, as well as 7R7.8.0 before SP1.
What type of attack does CVE-2014-0883 enable?
CVE-2014-0883 enables remote attackers to execute arbitrary web scripts or HTML through user input on the login screen.
Is CVE-2014-0883 a local or remote vulnerability?
CVE-2014-0883 is a remote vulnerability that can be exploited over the network.