NetSight
IP …
medium4.3

CVE-2013-0499

Cross-site scripting (XSS) vulnerability in the echo functionality on IBM WebSphere DataPower SOA appliances with firmware 3.8.2, 4.0, 4.0.1, 4.0.2, and 5.0.0 …

Impact

Cross-site scripting (XSS) vulnerability in the echo functionality on IBM WebSphere DataPower SOA appliances with firmware 3.8.2, 4.0, 4.0.1, 4.0.2, and 5.0.0 allows remote attackers to inject arbitrary web script or HTML via a SOAP message, as demonstrated by the XML Firewall, Multi Protocol Gateway (MPGW), Web Service Proxy, and Web Token services.

Affected products

VendorProductAffected versions
IbmWebsphere Datapower Xc10 Appliance Firmware
Versions 3.8.2, 4.0, 4.0.1, 4.0.2, 5.0.0
IbmWebsphere Datapower Xc10 Appliance
All versions
IbmWebsphere Datapower Service Gateway Xg45 Virtual Edition Firmware
Versions 3.8.2, 4.0, 4.0.1, 4.0.2, 5.0.0
IbmWebsphere Datapower Service Gateway Xg45 Virtual Edition
All versions
IbmWebsphere Datapower Service Gateway Xg45 Firmware
Versions 3.8.2, 4.0, 4.0.1, 4.0.2, 5.0.0
IbmWebsphere Datapower Service Gateway Xg45
All versions
IbmWebsphere Datapower Integration Appliance Xi52 Virtual Edition Firmware
Versions 3.8.2, 4.0, 4.0.1, 4.0.2, 5.0.0
IbmWebsphere Datapower Integration Appliance Xi52 Virtual Edition
All versions
IbmWebsphere Datapower Integration Appliance Xi52 Firmware
Versions 3.8.2, 4.0, 4.0.1, 4.0.2, 5.0.0
IbmWebsphere Datapower Integration Appliance Xi52
All versions
IbmWebsphere Datapower Integration Appliance Xi50 Firmware
Versions 3.8.2, 4.0, 4.0.1, 4.0.2, 5.0.0
IbmWebsphere Datapower Integration Appliance Xi50
All versions

Weakness classification

CWE-79

References