CVE-2013-0499

CWE-79 — Cross-site Scripting (XSS)3 documents3 sources

Severity

4.3MEDIUM

EPSS

0.3%

top 51.00%

CISA KEV

Not in KEV

Exploit

No known exploits

Affected products

IBM Websphere Datapower B2B Appliance Xb62 Firmware IBM Websphere Datapower Integration Appliance Xi50 Firmware IBM Websphere Datapower Integration Appliance Xi52 Firmware +4 more

Timeline

PublishedMay 28

Latest updateMay 5

Description

Cross-site scripting (XSS) vulnerability in the echo functionality on IBM WebSphere DataPower SOA appliances with firmware 3.8.2, 4.0, 4.0.1, 4.0.2, and 5.0.0 allows remote attackers to inject arbitrary web script or HTML via a SOAP message, as demonstrated by the XML Firewall, Multi Protocol Gateway (MPGW), Web Service Proxy, and Web Token services.

CVSS vector

AV:N/AC:M/C:N/I:P/A:NExploitability: 8.6 | Impact: 2.9

Affected Packages7 packages

▶NVDibm/websphere_datapower_service_gateway_xg45_firmware5 versions+4

▶NVDibm/websphere_datapower_service_gateway_xg45_virtual_edition_firmware5 versions+4

▶NVDibm/websphere_datapower_xc10_appliance_firmware5 versions+4

▶NVDibm/websphere_datapower_b2b_appliance_xb62_firmware5 versions+4

▶NVDibm/websphere_datapower_integration_appliance_xi50_firmware5 versions+4

🔴Vulnerability Details

GHSA

GHSA-r4rq-634f-573c: Cross-site scripting (XSS) vulnerability in the echo functionality on IBM WebSphere DataPower SOA appliances with firmware 3↗2022-05-05

▶

CVEList

CVE-2013-0499: Cross-site scripting (XSS) vulnerability in the echo functionality on IBM WebSphere DataPower SOA appliances with firmware 3↗2013-05-28

▶