PT-2012-2028
CVE-2011-5048
·
تاريخ النشر
2012-01-03
·
تاريخ التحديث
2017-08-29
الوصف من
CVSS 2.0
4.3
متوسطةالمقاييسAV:N/AC:M/Au:N/C:N/I:P/A:N
Name of the Vulnerable Software and Affected Versions
IBM Web Experience Factory versions 7.0 through 7.0.1
Description
The issue allows remote attackers to inject arbitrary web script or HTML via a text INPUT element or TEXTAREA element, related to an interaction between Smart Refresh and Dojo. This can be exploited to conduct cross-site scripting (XSS) attacks.
Recommendations
For IBM Web Experience Factory versions 7.0 through 7.0.1, consider disabling the Smart Refresh feature as a temporary workaround until a patch is available. Restrict access to TEXTAREA and INPUT elements to minimize the risk of exploitation.
وجدت خطأً في الوصف؟ لديك ما تضيفه؟ لا تتردد في مراسلتنا 👾