XSS in Ibm Websphere Datapower B2b Appliance Xb62
CVE-2013-0499
Cross-site scripting (XSS) vulnerability in the echo functionality on IBM WebSphere DataPower SOA appliances with firmware 3.8.2, 4.0, 4.0.1, 4.0.2, and 5.0.0 allows remote attackers to inject arbitrary web script or HTML via a SOAP message, as demonstrated by the XML Firewall, Multi Protocol Gateway (MPGW), Web Service Proxy, and Web Token services.
Vulnerability class: XSS (Cross-Site Scripting)
EPSS: 0.012 (65.2th percentile) — read the EPSS interpretation.
Affected products
- Ibm Websphere_datapower_b2b_appliance_xb62
- Ibm Websphere_datapower_b2b_appliance_xb62_firmware — versions 3.8.2, 4.0, 4.0.1
- Ibm Websphere_datapower_integration_appliance_xi50
- Ibm Websphere_datapower_integration_appliance_xi50_firmware — versions 3.8.2, 4.0, 4.0.1
- Ibm Websphere_datapower_integration_appliance_xi52
- Ibm Websphere_datapower_integration_appliance_xi52_firmware — versions 3.8.2, 4.0, 4.0.1
- Ibm Websphere_datapower_integration_appliance_xi52_virtual_edition
- Ibm Websphere_datapower_integration_appliance_xi52_virtual_edition_firmware — versions 3.8.2, 4.0, 4.0.1
- Ibm Websphere_datapower_service_gateway_xg45
- Ibm Websphere_datapower_service_gateway_xg45_firmware — versions 3.8.2, 4.0, 4.0.1
Weakness classification (CWE)
References
- psirt@us.ibm.com (Exploit, x_refsource_MISC)
- psirt@us.ibm.com (vdb-entry, x_refsource_XF)
- psirt@us.ibm.com (mailing-list, Exploit, x_refsource_BUGTRAQ)
- psirt@us.ibm.com (x_refsource_CONFIRM, Vendor Advisory)