CVE-2013-0499 Cross-site scripting in n/a
Remote attackers can inject arbitrary web script via SOAP messages in IBM DataPower appliances, requiring user interaction to execute.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2013-0499?
CVE-2013-0499 is a medium-severity cross-site scripting vulnerability in n/a, published on 28 May 2013. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Cross-site scripting (XSS) vulnerability in the echo functionality on IBM WebSphere DataPower SOA appliances with firmware 3.8.2, 4.0, 4.0.1, 4.0.2, and 5.0.0 allows remote attackers to inject arbitrary web script or HTML via a SOAP message, as demonstrated by the XML Firewall, Multi Protocol Gateway (MPGW), Web Service Proxy, and Web Token services.
Weakness: CWE-79
Which versions are affected by CVE-2013-0499?
It affects 14 products.
Products include Ibm Websphere Datapower B2b Appliance Xb62, Ibm Websphere Datapower B2b Appliance Xb62 Firmware, Ibm Websphere Datapower Integration Appliance Xi50, Ibm Websphere Datapower Integration Appliance Xi50 Firmware, Ibm Websphere Datapower Integration Appliance Xi52, Ibm Websphere Datapower Integration Appliance Xi52 Firmware and 8 more.
How do I fix CVE-2013-0499?
No fix has been published for CVE-2013-0499 yet. Limit exposure of the affected software until one is available.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2013-0499 being exploited?
There is no known exploitation of CVE-2013-0499 in the wild and no public exploit code.
Sources
Also known as GHSA-r4rq-634f-573c.