CVE-2014-0952: XSS

Published May 22, 2014

Updated

Cross-site scripting (XSS) vulnerability in bootconfig.jsp in IBM WebSphere Portal 6.1.0 through 6.1.0.6 CF27, 6.1.5 through 6.1.5.3 CF28, 7.0 through 7.0.0.2 CF28, and 8.0 before 8.0.0.1 CF12 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

Affected Software

58 affected components

IBM WebSphere Portal=6.1.0.0

IBM WebSphere Portal=6.1.0.1

IBM WebSphere Portal=6.1.0.2

IBM WebSphere Portal=6.1.0.3

IBM WebSphere Portal=6.1.0.4

IBM WebSphere Portal=6.1.0.5

IBM WebSphere Portal=6.1.0.6

IBM WebSphere Portal=6.1.0.6-cf27

IBM WebSphere Portal=6.1.5.0

IBM WebSphere Portal=6.1.5.1

IBM WebSphere Portal=6.1.5.2

IBM WebSphere Portal=6.1.5.3

IBM WebSphere Portal=6.1.5.3-cf27

IBM WebSphere Portal=7.0.0.0

IBM WebSphere Portal=7.0.0.0-cf001

IBM WebSphere Portal=7.0.0.1

IBM WebSphere Portal=7.0.0.1-cf002

IBM WebSphere Portal=7.0.0.1-cf003

IBM WebSphere Portal=7.0.0.1-cf004

IBM WebSphere Portal=7.0.0.1-cf005

IBM WebSphere Portal=7.0.0.1-cf006

IBM WebSphere Portal=7.0.0.1-cf007

IBM WebSphere Portal=7.0.0.1-cf008

IBM WebSphere Portal=7.0.0.1-cf009

IBM WebSphere Portal=7.0.0.1-cf010

IBM WebSphere Portal=7.0.0.1-cf019

IBM WebSphere Portal=7.0.0.2

IBM WebSphere Portal=7.0.0.2-cf011

IBM WebSphere Portal=7.0.0.2-cf012

IBM WebSphere Portal=7.0.0.2-cf013

IBM WebSphere Portal=7.0.0.2-cf014

IBM WebSphere Portal=7.0.0.2-cf015

IBM WebSphere Portal=7.0.0.2-cf016

IBM WebSphere Portal=7.0.0.2-cf017

IBM WebSphere Portal=7.0.0.2-cf018

IBM WebSphere Portal=7.0.0.2-cf019

IBM WebSphere Portal=7.0.0.2-cf020

IBM WebSphere Portal=7.0.0.2-cf021

IBM WebSphere Portal=7.0.0.2-cf022

IBM WebSphere Portal=7.0.0.2-cf23

IBM WebSphere Portal=7.0.0.2-cf24

IBM WebSphere Portal=7.0.0.2-cf25

IBM WebSphere Portal=7.0.0.2-cf26

IBM WebSphere Portal=7.0.0.2-cf27

IBM WebSphere Portal=8.0.0.0

IBM WebSphere Portal=8.0.0.0-cf01

IBM WebSphere Portal=8.0.0.0-cf02

IBM WebSphere Portal=8.0.0.0-cf03

IBM WebSphere Portal=8.0.0.0-cf04

IBM WebSphere Portal=8.0.0.0-cf05

IBM WebSphere Portal=8.0.0.1

IBM WebSphere Portal=8.0.0.1-cf04

IBM WebSphere Portal=8.0.0.1-cf05

IBM WebSphere Portal=8.0.0.1-cf07

IBM WebSphere Portal=8.0.0.1-cf08

IBM WebSphere Portal=8.0.0.1-cf09

IBM WebSphere Portal=8.0.0.1-cf10

IBM WebSphere Portal=8.0.0.1-cf11

Remediation

Patch Available

http://www-01.ibm.com/support/docview.wss?uid=swg21672572

Event History

May 22, 2014

CVE Published

via MITRE·10:00 AM

Data Sourced

via MITRE·10:00 AM

Description

Data Sourced

via NVD·11:14 AM

RemedyDescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the severity of CVE-2014-0952?

CVE-2014-0952 is classified as a medium severity cross-site scripting (XSS) vulnerability.

How do I fix CVE-2014-0952?

To fix CVE-2014-0952, apply the recommended patches and updates provided by IBM for the affected versions of WebSphere Portal.

Which versions of IBM WebSphere Portal are affected by CVE-2014-0952?

CVE-2014-0952 affects IBM WebSphere Portal versions 6.1.0 through 6.1.0.6, 6.1.5 through 6.1.5.3, 7.0 through 7.0.0.2, and 8.0 before 8.0.0.1.

Can CVE-2014-0952 be exploited remotely?

Yes, CVE-2014-0952 allows remote attackers to inject arbitrary web scripts or HTML.

What is the nature of the vulnerability in CVE-2014-0952?

CVE-2014-0952 is a cross-site scripting (XSS) vulnerability that can lead to malicious scripts being executed in the context of a user's session.