CVE-2015-4993: XSS

Published Dec 21, 2015

Updated

Cross-site scripting (XSS) vulnerability in IBM WebSphere Portal 6.1.0 through 6.1.0.6 CF27, 6.1.5 through 6.1.5.3 CF27, 7.0.0 through 7.0.0.2 CF29, 8.0.0 before 8.0.0.1 CF19, and 8.5.0 before CF08 allows remote attackers to inject arbitrary web script or HTML via a crafted URL, a different vulnerability than CVE-2015-4998.

Affected Software

17 affected components

IBM WebSphere Portal=6.1.0.0

IBM WebSphere Portal=6.1.0.1

IBM WebSphere Portal=6.1.0.2

IBM WebSphere Portal=6.1.0.3

IBM WebSphere Portal=6.1.0.4

IBM WebSphere Portal=6.1.0.5

IBM WebSphere Portal=6.1.0.6

IBM WebSphere Portal=6.1.5.0

IBM WebSphere Portal=6.1.5.1

IBM WebSphere Portal=6.1.5.2

IBM WebSphere Portal=6.1.5.3

IBM WebSphere Portal=7.0.0.0

IBM WebSphere Portal=7.0.0.1

IBM WebSphere Portal=7.0.0.2

IBM WebSphere Portal=8.0.0.0

IBM WebSphere Portal=8.0.0.1

IBM WebSphere Portal=8.5.0.0

Event History

Dec 21, 2015

CVE Published

via MITRE·11:00 AM

Data Sourced

via MITRE·11:00 AM

Description

Frequently Asked Questions

What is the severity of CVE-2015-4993?

CVE-2015-4993 is classified as a high severity cross-site scripting (XSS) vulnerability.

How do I fix CVE-2015-4993?

To fix CVE-2015-4993, upgrade IBM WebSphere Portal to a version that is not affected by this vulnerability.

Which versions of IBM WebSphere Portal are affected by CVE-2015-4993?

CVE-2015-4993 affects IBM WebSphere Portal versions 6.1.0, 6.1.5, 7.0.0, 8.0.0, and 8.5.0 prior to certain fix levels.

What can attackers achieve by exploiting CVE-2015-4993?

Exploiting CVE-2015-4993 allows attackers to inject arbitrary web scripts or HTML through crafted URLs.

Is there a workaround for CVE-2015-4993?

There are no documented workarounds for CVE-2015-4993; the recommended action is to apply the patches provided in the updates.