Details of VAR-201412-0357

ID

VAR-201412-0357

CVE

CVE-2014-6163

TITLE

IBM WebSphere DataPower XC10 Appliance cross-site scripting vulnerability

Trust: 0.8

sources: JVNDB: JVNDB-2014-005961

DESCRIPTION

Cross-site scripting (XSS) vulnerability on the IBM WebSphere DataPower XC10 appliance 2.1 and 2.5 before FP4 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL. Websphere Datapower Xc10 Appliance Firmware is prone to a cross-site scripting vulnerability. IBM WebSphere DataPower XC10 is a high-speed cache platform of IBM Corporation in the United States. The platform enables distributed caching of data with little to no change to existing applications

Trust: 1.98

sources: NVD: CVE-2014-6163 // JVNDB: JVNDB-2014-005961 // BID: 80090 // VULHUB: VHN-74106

AFFECTED PRODUCTS

vendor:	ibm	model:	websphere datapower xc10 appliance	scope:	eq	version:	2.5.0.0	Trust: 1.9
vendor:	ibm	model:	websphere datapower xc10 appliance	scope:	eq	version:	2.1.0.0	Trust: 1.9
vendor:	ibm	model:	websphere datapower xc10 the appliance	scope:	-	version:	-	Trust: 0.8
vendor:	ibm	model:	websphere datapower xc10 the appliance	scope:	eq	version:	2.1	Trust: 0.8
vendor:	ibm	model:	websphere datapower xc10 the appliance	scope:	lt	version:	2.5 thats all 2.5 fp4	Trust: 0.8

sources: BID: 80090 // JVNDB: JVNDB-2014-005961 // CNNVD: CNNVD-201412-281 // NVD: CVE-2014-6163

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov:	CVE-2014-6163
value:	LOW
Trust: 1.0
NVD:	CVE-2014-6163
value:	LOW
Trust: 0.8
CNNVD:	CNNVD-201412-281
value:	LOW
Trust: 0.6
VULHUB:	VHN-74106
value:	LOW
Trust: 0.1

nvd@nist.gov:	CVE-2014-6163
severity:	LOW
baseScore:	3.5
vectorString:	AV:N/AC:M/AU:S/C:N/I:P/A:N
accessVector:	NETWORK
accessComplexity:	MEDIUM
authentication:	SINGLE
confidentialityImpact:	NONE
integrityImpact:	PARTIAL
availabilityImpact:	NONE
exploitabilityScore:	6.8
impactScore:	2.9
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 1.8
VULHUB:	VHN-74106
severity:	LOW
baseScore:	3.5
vectorString:	AV:N/AC:M/AU:S/C:N/I:P/A:N
accessVector:	NETWORK
accessComplexity:	MEDIUM
authentication:	SINGLE
confidentialityImpact:	NONE
integrityImpact:	PARTIAL
availabilityImpact:	NONE
exploitabilityScore:	6.8
impactScore:	2.9
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.1

sources: VULHUB: VHN-74106 // JVNDB: JVNDB-2014-005961 // CNNVD: CNNVD-201412-281 // NVD: CVE-2014-6163

PROBLEMTYPE DATA

problemtype:

CWE-79

Trust: 1.9

sources: VULHUB: VHN-74106 // JVNDB: JVNDB-2014-005961 // NVD: CVE-2014-6163

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-201412-281

TYPE

XSS

Trust: 0.6

sources: CNNVD: CNNVD-201412-281

CONFIGURATIONS

sources: JVNDB: JVNDB-2014-005961

PATCH

title:

1691035

url:

http://www-01.ibm.com/support/docview.wss?uid=swg21691035

Trust: 0.8

sources: JVNDB: JVNDB-2014-005961

EXTERNAL IDS

db:	NVD	id:	CVE-2014-6163	Trust: 2.8
db:	XF	id:	97712	Trust: 0.9
db:	JVNDB	id:	JVNDB-2014-005961	Trust: 0.8
db:	CNNVD	id:	CNNVD-201412-281	Trust: 0.7
db:	BID	id:	80090	Trust: 0.4
db:	VULHUB	id:	VHN-74106	Trust: 0.1

sources: VULHUB: VHN-74106 // BID: 80090 // JVNDB: JVNDB-2014-005961 // CNNVD: CNNVD-201412-281 // NVD: CVE-2014-6163

REFERENCES

url:	http://www-01.ibm.com/support/docview.wss?uid=swg1it04614	Trust: 2.0
url:	http://www-01.ibm.com/support/docview.wss?uid=swg21691035	Trust: 2.0
url:	https://exchange.xforce.ibmcloud.com/vulnerabilities/97712	Trust: 1.1
url:	http://xforce.iss.net/xforce/xfdb/97712	Trust: 0.9
url:	http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2014-6163	Trust: 0.8
url:	https://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2014-6163	Trust: 0.8

sources: VULHUB: VHN-74106 // BID: 80090 // JVNDB: JVNDB-2014-005961 // CNNVD: CNNVD-201412-281 // NVD: CVE-2014-6163

CREDITS

Unknown

Trust: 0.3

sources: BID: 80090

SOURCES

db:	VULHUB	id:	VHN-74106
db:	BID	id:	80090
db:	JVNDB	id:	JVNDB-2014-005961
db:	CNNVD	id:	CNNVD-201412-281
db:	NVD	id:	CVE-2014-6163

LAST UPDATE DATE

2025-04-13T23:31:36.424000+00:00

SOURCES UPDATE DATE

db:	VULHUB	id:	VHN-74106	date:	2017-09-08T00:00:00
db:	BID	id:	80090	date:	2014-12-11T00:00:00
db:	JVNDB	id:	JVNDB-2014-005961	date:	2014-12-15T00:00:00
db:	CNNVD	id:	CNNVD-201412-281	date:	2014-12-12T00:00:00
db:	NVD	id:	CVE-2014-6163	date:	2025-04-12T10:46:40.837

SOURCES RELEASE DATE

db:	VULHUB	id:	VHN-74106	date:	2014-12-11T00:00:00
db:	BID	id:	80090	date:	2014-12-11T00:00:00
db:	JVNDB	id:	JVNDB-2014-005961	date:	2014-12-15T00:00:00
db:	CNNVD	id:	CNNVD-201412-281	date:	2014-12-12T00:00:00
db:	NVD	id:	CVE-2014-6163	date:	2014-12-11T16:59:02.490