CVE-2016-5981

Опубликовано: 25 нояб. 2016

Источник: nvd

CVSS3: 5.4

CVSS2: 3.5

EPSS Низкий

Описание

Cross-site scripting (XSS) vulnerability in IBM FileNet Workplace XT through 1.1.5.2-WPXT-LA011 and FileNet Workplace (Application Engine) through 4.0.2.14-P8AE-IF001, when RegExpSecurityFilter and ScriptSecurityFilter are misconfigured, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

Ссылки

http://www-01.ibm.com/support/docview.wss?uid=swg21990899
Mitigation
Vendor Advisory
http://www.securityfocus.com/bid/94517
http://www-01.ibm.com/support/docview.wss?uid=swg21990899
Mitigation
Vendor Advisory
http://www.securityfocus.com/bid/94517

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:ibm:filenet_workplace:*:*:*:*:*:*:*:*

Версия до 4.0.2.14-p8ae-if001 (включая)

cpe:2.3:a:ibm:filenet_workplace_xt:*:*:*:*:*:*:*:*

Версия до 1.1.5.2-wpxt-la011 (включая)

EPSS

Процентиль: 35%

0.00143

Низкий

5.4 Medium

CVSS3

3.5 Low

CVSS2

Дефекты

CWE-79

Связанные уязвимости

GHSA-hrg3-rx4r-2gmf