CVE-2015-1908: XSS

Published Apr 24, 2015

Updated

Cross-site scripting (XSS) vulnerability in IBM WebSphere Portal 6.1.0 through 6.1.0.6 CF27, 6.1.5 through 6.1.5.3 CF27, 7.0.0 through 7.0.0.2 CF29, 8.0.0 before 8.0.0.1 CF16, and 8.5.0 through CF05, as used in Web Content Manager and other products, allows remote attackers to inject arbitrary web script or HTML via a crafted URL.

Affected Software

17 affected components

IBM WebSphere Portal=6.1.0.0

IBM WebSphere Portal=6.1.0.1

IBM WebSphere Portal=6.1.0.2

IBM WebSphere Portal=6.1.0.3

IBM WebSphere Portal=6.1.0.4

IBM WebSphere Portal=6.1.0.5

IBM WebSphere Portal=6.1.0.6

IBM WebSphere Portal=6.1.5.0

IBM WebSphere Portal=6.1.5.1

IBM WebSphere Portal=6.1.5.2

IBM WebSphere Portal=6.1.5.3

IBM WebSphere Portal=7.0.0.0

IBM WebSphere Portal=7.0.0.1

IBM WebSphere Portal=7.0.0.2

IBM WebSphere Portal=8.0.0.0

IBM WebSphere Portal=8.0.0.1

IBM WebSphere Portal=8.5.0.0

Remediation

Patch Available

http://www-01.ibm.com/support/docview.wss?uid=swg21701566

Event History

Apr 24, 2015

CVE Published

via MITRE·11:00 PM

Data Sourced

via MITRE·11:00 PM

Description

Frequently Asked Questions

What is the severity of CVE-2015-1908?

CVE-2015-1908 is classified as a medium severity cross-site scripting (XSS) vulnerability.

How do I fix CVE-2015-1908?

To fix CVE-2015-1908, update your IBM WebSphere Portal to a fixed version that addresses the XSS vulnerability.

Which versions of IBM WebSphere Portal are affected by CVE-2015-1908?

CVE-2015-1908 affects IBM WebSphere Portal versions 6.1.0 through 6.1.0.6, 6.1.5 through 6.1.5.3, 7.0.0 through 7.0.0.2, and 8.0.0 before 8.0.0.1.

What type of vulnerability is CVE-2015-1908?

CVE-2015-1908 is a cross-site scripting (XSS) vulnerability allowing remote attackers to inject arbitrary web scripts.

Can CVE-2015-1908 be exploited remotely?

Yes, CVE-2015-1908 can be exploited remotely by attackers to execute malicious scripts in the context of the user's session.