Vulnerability-Lookup

CNVD-2016-08129

Vulnerability from cnvd - Published: 2016-09-27

Title

IBM Security Privileged Identity Manager Virtual Appliance跨站脚本漏洞

Description

IBM Security Privileged Identity Manager是美国IBM公司的一款身份监管解决方案（IBM Identity Governance and Management）中的身份管理产品，它主要用于保护、自动执行并审计特权身份的使用，以帮助抵御内部威胁并提高安全性。IBM Security Privileged Identity Manager Virtual是其中的一个虚拟管理设备。 IBM Security Privileged Identity Manager Virtual Appliance 2.0版本中存在跨站脚本漏洞。攻击者可利用该漏洞在Web UI中注入任意JavaScript代码。

Severity

中

Patch Name

IBM Security Privileged Identity Manager Virtual Appliance跨站脚本漏洞的补丁

Patch Description

Formal description

用户可参考如下厂商提供的安全补丁以修复该漏洞： http://www-01.ibm.com/support/docview.wss?uid=swg21989205

Reference

http://www.securityfocus.com/bid/93078

Impacted products

Name
IBM Security Identity Manager Virtual Appliance 2.*，<2.0.2 FP8

Show details on source website

JSON

To clipboard

{
  "bids": {
    "bid": {
      "bidNumber": "93078"
    }
  },
  "cves": {
    "cve": {
      "cveNumber": "CVE-2016-5974"
    }
  },
  "description": "IBM Security Privileged Identity Manager\u662f\u7f8e\u56fdIBM\u516c\u53f8\u7684\u4e00\u6b3e\u8eab\u4efd\u76d1\u7ba1\u89e3\u51b3\u65b9\u6848\uff08IBM Identity Governance and Management\uff09\u4e2d\u7684\u8eab\u4efd\u7ba1\u7406\u4ea7\u54c1\uff0c\u5b83\u4e3b\u8981\u7528\u4e8e\u4fdd\u62a4\u3001\u81ea\u52a8\u6267\u884c\u5e76\u5ba1\u8ba1\u7279\u6743\u8eab\u4efd\u7684\u4f7f\u7528\uff0c\u4ee5\u5e2e\u52a9\u62b5\u5fa1\u5185\u90e8\u5a01\u80c1\u5e76\u63d0\u9ad8\u5b89\u5168\u6027\u3002IBM Security Privileged Identity Manager Virtual\u662f\u5176\u4e2d\u7684\u4e00\u4e2a\u865a\u62df\u7ba1\u7406\u8bbe\u5907\u3002\r\n\r\nIBM Security Privileged Identity Manager Virtual Appliance 2.0\u7248\u672c\u4e2d\u5b58\u5728\u8de8\u7ad9\u811a\u672c\u6f0f\u6d1e\u3002\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u5728Web UI\u4e2d\u6ce8\u5165\u4efb\u610fJavaScript\u4ee3\u7801\u3002",
  "discovererName": "IBM X-Force Ethical Hacking Team: Paul Ionescu, Warren Moynihan, Jonathan Fitz-Gerald, John Zuccato, Rodney Ryan, Chris Shepherd, Dmitryi Beryoza.",
  "formalWay": "\u7528\u6237\u53ef\u53c2\u8003\u5982\u4e0b\u5382\u5546\u63d0\u4f9b\u7684\u5b89\u5168\u8865\u4e01\u4ee5\u4fee\u590d\u8be5\u6f0f\u6d1e\uff1a\r\nhttp://www-01.ibm.com/support/docview.wss?uid=swg21989205",
  "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
  "number": "CNVD-2016-08129",
  "openTime": "2016-09-27",
  "patchDescription": "IBM Security Privileged Identity Manager\u662f\u7f8e\u56fdIBM\u516c\u53f8\u7684\u4e00\u6b3e\u8eab\u4efd\u76d1\u7ba1\u89e3\u51b3\u65b9\u6848\uff08IBM Identity Governance and Management\uff09\u4e2d\u7684\u8eab\u4efd\u7ba1\u7406\u4ea7\u54c1\uff0c\u5b83\u4e3b\u8981\u7528\u4e8e\u4fdd\u62a4\u3001\u81ea\u52a8\u6267\u884c\u5e76\u5ba1\u8ba1\u7279\u6743\u8eab\u4efd\u7684\u4f7f\u7528\uff0c\u4ee5\u5e2e\u52a9\u62b5\u5fa1\u5185\u90e8\u5a01\u80c1\u5e76\u63d0\u9ad8\u5b89\u5168\u6027\u3002IBM Security Privileged Identity Manager Virtual\u662f\u5176\u4e2d\u7684\u4e00\u4e2a\u865a\u62df\u7ba1\u7406\u8bbe\u5907\u3002\r\n\r\nIBM Security Privileged Identity Manager Virtual Appliance 2.0\u7248\u672c\u4e2d\u5b58\u5728\u8de8\u7ad9\u811a\u672c\u6f0f\u6d1e\u3002\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u5728Web UI\u4e2d\u6ce8\u5165\u4efb\u610fJavaScript\u4ee3\u7801\u3002\u76ee\u524d\uff0c\u4f9b\u5e94\u5546\u53d1\u5e03\u4e86\u5b89\u5168\u516c\u544a\u53ca\u76f8\u5173\u8865\u4e01\u4fe1\u606f\uff0c\u4fee\u590d\u4e86\u6b64\u6f0f\u6d1e\u3002",
  "patchName": "IBM Security Privileged Identity Manager Virtual Appliance\u8de8\u7ad9\u811a\u672c\u6f0f\u6d1e\u7684\u8865\u4e01",
  "products": {
    "product": "IBM Security Identity Manager Virtual Appliance 2.*\uff0c\u003c2.0.2 FP8"
  },
  "referenceLink": "http://www.securityfocus.com/bid/93078",
  "serverity": "\u4e2d",
  "submitTime": "2016-09-24",
  "title": "IBM Security Privileged Identity Manager Virtual Appliance\u8de8\u7ad9\u811a\u672c\u6f0f\u6d1e"
}

CVE-2016-5974 (GCVE-0-2016-5974)

Vulnerability from cvelistv5 – Published: 2016-09-26 01:00 – Updated: 2024-08-06 01:15

Summary

Cross-site scripting (XSS) vulnerability in the Web UI in IBM Security Privileged Identity Manager (ISPIM) Virtual Appliance 2.x before 2.0.2 FP8 allows remote authenticated users to inject arbitrary web script or HTML via an embedded string.

Severity

No CVSS data available.

CWE

Assigner

ibm

References

1 reference

URL	Tags
http://www-01.ibm.com/support/docview.wss?uid=swg…	x_refsource_CONFIRM

Date Public

2016-09-12 00:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-06T01:15:10.907Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://www-01.ibm.com/support/docview.wss?uid=swg21989205"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2016-09-12T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Cross-site scripting (XSS) vulnerability in the Web UI in IBM Security Privileged Identity Manager (ISPIM) Virtual Appliance 2.x before 2.0.2 FP8 allows remote authenticated users to inject arbitrary web script or HTML via an embedded string."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2016-09-26T03:57:01.000Z",
        "orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
        "shortName": "ibm"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://www-01.ibm.com/support/docview.wss?uid=swg21989205"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "psirt@us.ibm.com",
          "ID": "CVE-2016-5974",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Cross-site scripting (XSS) vulnerability in the Web UI in IBM Security Privileged Identity Manager (ISPIM) Virtual Appliance 2.x before 2.0.2 FP8 allows remote authenticated users to inject arbitrary web script or HTML via an embedded string."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "http://www-01.ibm.com/support/docview.wss?uid=swg21989205",
              "refsource": "CONFIRM",
              "url": "http://www-01.ibm.com/support/docview.wss?uid=swg21989205"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
    "assignerShortName": "ibm",
    "cveId": "CVE-2016-5974",
    "datePublished": "2016-09-26T01:00:00.000Z",
    "dateReserved": "2016-06-29T00:00:00.000Z",
    "dateUpdated": "2024-08-06T01:15:10.907Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

CNVD-2016-08129

CVE-2016-5974 (GCVE-0-2016-5974)

Tags

Sightings

Nomenclature