CVE-2024-35153

Опубликовано: 27 июн. 2024

Источник: nvd

CVSS3: 4.8

EPSS Низкий

Описание

IBM WebSphere Application Server 8.5 and 9.0 is vulnerable to cross-site scripting. This vulnerability allows a privileged user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 292640.

Ссылки

https://exchange.xforce.ibmcloud.com/vulnerabilities/292640
VDB Entry
Vendor Advisory
https://www.ibm.com/support/pages/node/7158662
Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/292640
VDB Entry
Vendor Advisory
https://www.ibm.com/support/pages/node/7158662
Vendor Advisory

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:ibm:websphere_application_server:*:*:*:*:*:*:*:*

Версия от 8.5.0.0 (включая) до 8.5.5.26 (исключая)

cpe:2.3:a:ibm:websphere_application_server:*:*:*:*:*:*:*:*

Версия от 9.0.0.0 (включая) до 9.0.5.21 (исключая)

EPSS

Процентиль: 54%

0.00309

Низкий

4.8 Medium

CVSS3

Дефекты

CWE-79

Связанные уязвимости

GHSA-c2mw-q3h6-pvx6