CVE-2014-6079: XSS

Published Oct 3, 2014

Updated

Cross-site scripting (XSS) vulnerability in the Local Management Interface in IBM Security Access Manager for Web 7.x before 7.0.0-ISS-WGA-IF0009 and 8.x before 8.0.0-ISS-WGA-FP0005, and Security Access Manager for Mobile 8.x before 8.0.0-ISS-ISAM-FP0005, allows remote attackers to inject arbitrary web script or HTML via a crafted URL.

Affected Software

19 affected components

IBM Security Access Manager For Mobile 8.0 Firmware=8.0.0.0

IBM Security Access Manager For Mobile 8.0 Firmware=8.0.0.1

IBM Security Access Manager For Mobile 8.0 Firmware=8.0.0.3

IBM Security Access Manager For Mobile 8.0 Firmware=8.0.0.4

IBM Security Access Manager For Mobile Appliance=8.0

IBM Security Access Manager For Web 7.0 Firmware=7.0.0.0

IBM Security Access Manager For Web 7.0 Firmware=7.0.0.1

IBM Security Access Manager For Web 7.0 Firmware=7.0.0.2

IBM Security Access Manager For Web 7.0 Firmware=7.0.0.3

IBM Security Access Manager For Web 7.0 Firmware=7.0.0.4

IBM Security Access Manager For Web 7.0 Firmware=7.0.0.5

IBM Security Access Manager For Web 7.0 Firmware=7.0.0.6

IBM Security Access Manager For Web 7.0 Firmware=7.0.0.7

IBM Security Access Manager For Web 7.0 Firmware=7.0.0.8

IBM Security Access Manager For Web Appliance=7.0

IBM Security Access Manager For Web 8.0 Firmware=8.0.0.2

IBM Security Access Manager For Web 8.0 Firmware=8.0.0.3

IBM Security Access Manager For Web 8.0 Firmware=8.0.0.4

IBM Security Access Manager For Web Appliance=8.0

Remediation

Patch Available

http://www-01.ibm.com/support/docview.wss?uid=swg21684466

Event History

Oct 3, 2014

CVE Published

via MITRE·01:00 AM

Data Sourced

via MITRE·01:00 AM

Description

Frequently Asked Questions

What is the severity of CVE-2014-6079?

CVE-2014-6079 is classified as a high-severity cross-site scripting vulnerability.

How do I fix CVE-2014-6079?

To fix CVE-2014-6079, upgrade IBM Security Access Manager for Web to version 7.0.0-ISS-WGA-IF0009 or 8.0.0-ISS-WGA-FP0005.

What are the affected versions for CVE-2014-6079?

CVE-2014-6079 affects IBM Security Access Manager for Web versions 7.x before 7.0.0-ISS-WGA-IF0009 and 8.x before 8.0.0-ISS-WGA-FP0005.

Can CVE-2014-6079 be exploited remotely?

Yes, CVE-2014-6079 allows remote attackers to inject arbitrary scripts through the Local Management Interface.

Is there a workaround for CVE-2014-6079 if I cannot update immediately?

There are no recommended workarounds for CVE-2014-6079; updating to the fixed versions is essential.