CVE-2014-4837: XSS
First published: Sun Oct 19 2014(Updated: )
Cross-site scripting (XSS) vulnerability in NewDocument.jsp in IBM TRIRIGA Application Platform 3.2 and 3.3 before 3.3.0.2, 3.3.1 before 3.3.1.3, 3.3.2 before 3.3.2.2, and 3.4 before 3.4.0.1 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL.
Credit: psirt@us.ibm.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| IBM TRIRIGA Application Platform | =3.2 | |
| IBM TRIRIGA Application Platform | =3.2.1 | |
| IBM TRIRIGA Application Platform | =3.3.0.0 | |
| IBM TRIRIGA Application Platform | =3.3.0.1 | |
| IBM TRIRIGA Application Platform | =3.3.1.0 | |
| IBM TRIRIGA Application Platform | =3.3.1.1 | |
| IBM TRIRIGA Application Platform | =3.3.1.2 | |
| IBM TRIRIGA Application Platform | =3.3.2.0 | |
| IBM TRIRIGA Application Platform | =3.3.2.1 | |
| IBM TRIRIGA Application Platform | =3.4.0.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2014-4837?
The CVE-2014-4837 vulnerability is considered to be of high severity due to the risk of cross-site scripting attacks.
Which versions of IBM TRIRIGA Application Platform are affected by CVE-2014-4837?
CVE-2014-4837 affects IBM TRIRIGA Application Platform versions 3.2, 3.3 before 3.3.0.2, 3.3.1 before 3.3.1.3, 3.3.2 before 3.3.2.2, and 3.4 before 3.4.0.1.
How do I fix CVE-2014-4837?
To fix CVE-2014-4837, upgrade the IBM TRIRIGA Application Platform to the patched versions 3.3.0.2, 3.3.1.3, 3.3.2.2, or 3.4.0.1 or later.
What is the nature of the vulnerability CVE-2014-4837?
CVE-2014-4837 is a cross-site scripting (XSS) vulnerability that allows remote authenticated users to inject arbitrary web script or HTML.
Who can exploit CVE-2014-4837?
CVE-2014-4837 can be exploited by remote authenticated users who can craft a malicious URL.
- collector/nvd-index
- agent/type
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/severity
- agent/weakness
- agent/references
- agent/author
- agent/last-modified-date
- agent/tags
- agent/first-publish-date
- agent/description
- agent/event
- agent/source
- vendor/ibm
- canonical/ibm tririga application platform
- version/ibm tririga application platform/3.2
- version/ibm tririga application platform/3.2.1
- version/ibm tririga application platform/3.3.0.0
- version/ibm tririga application platform/3.3.0.1
- version/ibm tririga application platform/3.3.1.0
- version/ibm tririga application platform/3.3.1.1
- version/ibm tririga application platform/3.3.1.2
- version/ibm tririga application platform/3.3.2.0
- version/ibm tririga application platform/3.3.2.1
- version/ibm tririga application platform/3.4.0.0