Vulnerability-Lookup

CNVD-2016-02911

Vulnerability from cnvd - Published: 2016-05-11

Title

IBM Security Identity Manager Virtual Appliance跨站脚本漏洞

Description

IBM Security Identity Manager（ISIM）是美国IBM公司的一套身份管理和治理解决方案。该方案可在整个用户生命周期内自动创建、修改、重新认证和终止用户特权，并支持基于策略的密码管理。IBM Security Identity Manager（ISIM）Virtual Appliance是ISIM虚拟应用程序。 ISIM Virtual Appliance中存在跨站脚本漏洞，该漏洞源于程序未能正确验证用户输入。远程攻击者可借助特制的URL利用该漏洞注入任意Web脚本或HTML。

Severity

中

Patch Name

IBM Security Identity Manager Virtual Appliance跨站脚本漏洞的补丁

Patch Description

Formal description

目前厂商已经发布了升级补丁以修复此安全问题，补丁获取链接： http://www-01.ibm.com/support/docview.wss?uid=swg21981438

Reference

https://www.auscert.org.au/render.html?it=34058

Impacted products

Name
['IBM Security Identity Manager Virtual Appliance 7.0.0.0', 'IBM Security Identity Manager Virtual Appliance 7.0.0.1', 'IBM Security Identity Manager Virtual Appliance 7.0.0.2', 'IBM Security Identity Manager Virtual Appliance 7.0.0.3', 'IBM Security Identity Manager Virtual Appliance 7.0.1.0']

Show details on source website

JSON

To clipboard

{
  "cves": {
    "cve": {
      "cveNumber": "CVE-2016-0336"
    }
  },
  "description": "IBM Security Identity Manager\uff08ISIM\uff09\u662f\u7f8e\u56fdIBM\u516c\u53f8\u7684\u4e00\u5957\u8eab\u4efd\u7ba1\u7406\u548c\u6cbb\u7406\u89e3\u51b3\u65b9\u6848\u3002\u8be5\u65b9\u6848\u53ef\u5728\u6574\u4e2a\u7528\u6237\u751f\u547d\u5468\u671f\u5185\u81ea\u52a8\u521b\u5efa\u3001\u4fee\u6539\u3001\u91cd\u65b0\u8ba4\u8bc1\u548c\u7ec8\u6b62\u7528\u6237\u7279\u6743\uff0c\u5e76\u652f\u6301\u57fa\u4e8e\u7b56\u7565\u7684\u5bc6\u7801\u7ba1\u7406\u3002IBM Security Identity Manager\uff08ISIM\uff09Virtual Appliance\u662fISIM\u865a\u62df\u5e94\u7528\u7a0b\u5e8f\u3002\r\n\r\nISIM Virtual Appliance\u4e2d\u5b58\u5728\u8de8\u7ad9\u811a\u672c\u6f0f\u6d1e\uff0c\u8be5\u6f0f\u6d1e\u6e90\u4e8e\u7a0b\u5e8f\u672a\u80fd\u6b63\u786e\u9a8c\u8bc1\u7528\u6237\u8f93\u5165\u3002\u8fdc\u7a0b\u653b\u51fb\u8005\u53ef\u501f\u52a9\u7279\u5236\u7684URL\u5229\u7528\u8be5\u6f0f\u6d1e\u6ce8\u5165\u4efb\u610fWeb\u811a\u672c\u6216HTML\u3002",
  "discovererName": "IBM",
  "formalWay": "\u76ee\u524d\u5382\u5546\u5df2\u7ecf\u53d1\u5e03\u4e86\u5347\u7ea7\u8865\u4e01\u4ee5\u4fee\u590d\u6b64\u5b89\u5168\u95ee\u9898\uff0c\u8865\u4e01\u83b7\u53d6\u94fe\u63a5\uff1a \r\nhttp://www-01.ibm.com/support/docview.wss?uid=swg21981438",
  "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
  "number": "CNVD-2016-02911",
  "openTime": "2016-05-11",
  "patchDescription": "IBM Security Identity Manager\uff08ISIM\uff09\u662f\u7f8e\u56fdIBM\u516c\u53f8\u7684\u4e00\u5957\u8eab\u4efd\u7ba1\u7406\u548c\u6cbb\u7406\u89e3\u51b3\u65b9\u6848\u3002\u8be5\u65b9\u6848\u53ef\u5728\u6574\u4e2a\u7528\u6237\u751f\u547d\u5468\u671f\u5185\u81ea\u52a8\u521b\u5efa\u3001\u4fee\u6539\u3001\u91cd\u65b0\u8ba4\u8bc1\u548c\u7ec8\u6b62\u7528\u6237\u7279\u6743\uff0c\u5e76\u652f\u6301\u57fa\u4e8e\u7b56\u7565\u7684\u5bc6\u7801\u7ba1\u7406\u3002IBM Security Identity Manager\uff08ISIM\uff09Virtual Appliance\u662fISIM\u865a\u62df\u5e94\u7528\u7a0b\u5e8f\u3002\r\n\r\nISIM Virtual Appliance\u4e2d\u5b58\u5728\u8de8\u7ad9\u811a\u672c\u6f0f\u6d1e\uff0c\u8be5\u6f0f\u6d1e\u6e90\u4e8e\u7a0b\u5e8f\u672a\u80fd\u6b63\u786e\u9a8c\u8bc1\u7528\u6237\u8f93\u5165\u3002\u8fdc\u7a0b\u653b\u51fb\u8005\u53ef\u501f\u52a9\u7279\u5236\u7684URL\u5229\u7528\u8be5\u6f0f\u6d1e\u6ce8\u5165\u4efb\u610fWeb\u811a\u672c\u6216HTML\u3002\u76ee\u524d\uff0c\u4f9b\u5e94\u5546\u53d1\u5e03\u4e86\u5b89\u5168\u516c\u544a\u53ca\u76f8\u5173\u8865\u4e01\u4fe1\u606f\uff0c\u4fee\u590d\u4e86\u6b64\u6f0f\u6d1e\u3002",
  "patchName": "IBM Security Identity Manager Virtual Appliance\u8de8\u7ad9\u811a\u672c\u6f0f\u6d1e\u7684\u8865\u4e01",
  "products": {
    "product": [
      "IBM Security Identity Manager Virtual Appliance 7.0.0.0",
      "IBM Security Identity Manager Virtual Appliance 7.0.0.1",
      "IBM Security Identity Manager Virtual Appliance 7.0.0.2",
      "IBM Security Identity Manager Virtual Appliance 7.0.0.3",
      "IBM Security Identity Manager Virtual Appliance 7.0.1.0"
    ]
  },
  "referenceLink": "https://www.auscert.org.au/render.html?it=34058",
  "serverity": "\u4e2d",
  "submitTime": "2016-05-06",
  "title": "IBM Security Identity Manager Virtual Appliance\u8de8\u7ad9\u811a\u672c\u6f0f\u6d1e"
}

CVE-2016-0336 (GCVE-0-2016-0336)

Vulnerability from cvelistv5 – Published: 2018-01-12 17:00 – Updated: 2024-08-05 22:15

Summary

Cross-site scripting (XSS) vulnerability in IBM Security Identity Manager (ISIM) Virtual Appliance 7.0.0.0 through 7.0.1.0 before 7.0.1-ISS-SIM-FP0001 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors. IBM X-Force ID: 111737.

Severity

No CVSS data available.

CWE

Assigner

ibm

References

2 references

URL	Tags
http://www-01.ibm.com/support/docview.wss?uid=swg…	x_refsource_CONFIRM
https://exchange.xforce.ibmcloud.com/vulnerabilit…	vdb-entryx_refsource_XF

Date Public

2016-04-15 00:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T22:15:23.443Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://www-01.ibm.com/support/docview.wss?uid=swg21981438"
          },
          {
            "name": "ibm-sim-cve20160336-xss(111737)",
            "tags": [
              "vdb-entry",
              "x_refsource_XF",
              "x_transferred"
            ],
            "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/111737"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2016-04-15T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Cross-site scripting (XSS) vulnerability in IBM Security Identity Manager (ISIM) Virtual Appliance 7.0.0.0 through 7.0.1.0 before 7.0.1-ISS-SIM-FP0001 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors. IBM X-Force ID: 111737."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2018-01-12T16:57:01.000Z",
        "orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
        "shortName": "ibm"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://www-01.ibm.com/support/docview.wss?uid=swg21981438"
        },
        {
          "name": "ibm-sim-cve20160336-xss(111737)",
          "tags": [
            "vdb-entry",
            "x_refsource_XF"
          ],
          "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/111737"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "psirt@us.ibm.com",
          "ID": "CVE-2016-0336",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Cross-site scripting (XSS) vulnerability in IBM Security Identity Manager (ISIM) Virtual Appliance 7.0.0.0 through 7.0.1.0 before 7.0.1-ISS-SIM-FP0001 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors. IBM X-Force ID: 111737."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "http://www-01.ibm.com/support/docview.wss?uid=swg21981438",
              "refsource": "CONFIRM",
              "url": "http://www-01.ibm.com/support/docview.wss?uid=swg21981438"
            },
            {
              "name": "ibm-sim-cve20160336-xss(111737)",
              "refsource": "XF",
              "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/111737"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
    "assignerShortName": "ibm",
    "cveId": "CVE-2016-0336",
    "datePublished": "2018-01-12T17:00:00.000Z",
    "dateReserved": "2015-12-08T00:00:00.000Z",
    "dateUpdated": "2024-08-05T22:15:23.443Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

CNVD-2016-02911

CVE-2016-0336 (GCVE-0-2016-0336)

Tags

Sightings

Nomenclature