CVE-2020-4384

CWE-79 — Cross-site Scripting (XSS)4 documents4 sources
Severity
5.4MEDIUM
EPSS
0.2%
top 60.44%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
IBM Infosphere Information ServerIBM Infosphere Information Server ON CloudIBM Infosphere Qualitystage
Timeline
PublishedMay 6
Latest updateMay 24

Description

IBM InfoSphere Information Server 11.3, 11.5, and 11.7 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 179265.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:NExploitability: 2.3 | Impact: 2.7

Affected Packages3 packages

▶CVEListV5ibm/infosphere_information_server11.3, 11.5, 11.7+2
▶NVDibm/infosphere_information11.5, 11.7+1
▶NVDibm/infosphere_qualitystage11.3, 11.5, 11.7+2

🔴Vulnerability Details

2
GHSA
GHSA-j224-c526-25gp: IBM InfoSphere Information Server 11↗2022-05-24
▶
CVEList
CVE-2020-4384: IBM InfoSphere Information Server 11↗2020-05-06
▶

💬Community

1
Bugzilla
CVE-2020-25680 httpd: allow connecting via SSL to a backend worker when the backend keystore file's ID is 'unknown'↗2020-10-29
▶
CVE-2020-4384 (MEDIUM CVSS 5.4) | IBM InfoSphere Information Server 1 | cvebase.io