CVE-2017-1121: XSS

Published Feb 13, 2017

Updated

IBM WebSphere Application Server 7.0, 8.0, and 9.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM Reference #: 1997743

Affected Software

5 affected components

IBM WebSphere Application Server Feature Pack for Web Services=7.0

IBM WebSphere Application Server Feature Pack for Web Services=8.0

IBM WebSphere Application Server Feature Pack for Web Services=8.5

IBM WebSphere Application Server Feature Pack for Web Services=8.5.5

IBM WebSphere Application Server Feature Pack for Web Services=9.0

Remediation

Patch Available

http://www.ibm.com/support/docview.wss?uid=swg21997743

Event History

Feb 13, 2017

CVE Published

via MITRE·10:00 PM

Data Sourced

via MITRE·10:00 PM

DescriptionWeakness

Data Sourced

via NVD·10:59 PM

RemedyDescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the severity of CVE-2017-1121?

CVE-2017-1121 is classified as a medium severity cross-site scripting vulnerability.

How do I fix CVE-2017-1121?

To fix CVE-2017-1121, upgrade IBM WebSphere Application Server to a patched version provided by IBM.

What versions of IBM WebSphere are affected by CVE-2017-1121?

CVE-2017-1121 affects IBM WebSphere Application Server versions 7.0, 8.0, 8.5, 8.5.5, and 9.0.

What type of vulnerability is CVE-2017-1121?

CVE-2017-1121 is a cross-site scripting (XSS) vulnerability that allows execution of arbitrary JavaScript code.

What is the impact of CVE-2017-1121?

CVE-2017-1121 can lead to credentials disclosure within a trusted session due to the execution of malicious scripts.