CVE-2006-2431

Cross-site scripting (XSS) vulnerability in the 500 Internal Server Error page on the SOAP port (8880/tcp) in IBM WebSphere Application Server 5.0.2 and earlier, 5.1.x before 5.1.1.12, and 6.0.2 up to 6.0.2.7, allows remote attackers to inject arbitrary web script or HTML via the URI, which is contained in a FAULTACTOR element on this page. NOTE: some sources have reported the element as "faultfactor," but this is likely erroneous.
References
Link Resource
http://archives.neohapsis.com/archives/bugtraq/2006-05/0175.html Patch
http://secunia.com/advisories/20032 Patch Vendor Advisory
http://securityreason.com/securityalert/910
http://securitytracker.com/id?1017170
http://www-1.ibm.com/support/docview.wss?rs=0&dc=DB550&q1=PK16492&uid=swg1PK22416&loc=en_US&cs=utf-8&lang= Patch
http://www-1.ibm.com/support/docview.wss?rs=180&uid=swg24012064 Patch
http://www-1.ibm.com/support/docview.wss?rs=180&uid=swg24012163 Patch
http://www-1.ibm.com/support/search.wss?rs=0&q=PK16602&apar=only Patch
http://www-1.ibm.com/support/search.wss?rs=0&q=PK26181&apar=only
http://www.attrition.org/pipermail/vim/2006-November/001112.html
http://www.niscc.gov.uk/niscc/docs/re-20061031-00727.pdf?lang=en
http://www.osvdb.org/25371
http://www.securityfocus.com/archive/1/450704/100/0/threaded
http://www.securityfocus.com/bid/21018
http://www.vupen.com/english/advisories/2006/1736 Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/30055
http://archives.neohapsis.com/archives/bugtraq/2006-05/0175.html Patch
http://secunia.com/advisories/20032 Patch Vendor Advisory
http://securityreason.com/securityalert/910
http://securitytracker.com/id?1017170
http://www-1.ibm.com/support/docview.wss?rs=0&dc=DB550&q1=PK16492&uid=swg1PK22416&loc=en_US&cs=utf-8&lang= Patch
http://www-1.ibm.com/support/docview.wss?rs=180&uid=swg24012064 Patch
http://www-1.ibm.com/support/docview.wss?rs=180&uid=swg24012163 Patch
http://www-1.ibm.com/support/search.wss?rs=0&q=PK16602&apar=only Patch
http://www-1.ibm.com/support/search.wss?rs=0&q=PK26181&apar=only
http://www.attrition.org/pipermail/vim/2006-November/001112.html
http://www.niscc.gov.uk/niscc/docs/re-20061031-00727.pdf?lang=en
http://www.osvdb.org/25371
http://www.securityfocus.com/archive/1/450704/100/0/threaded
http://www.securityfocus.com/bid/21018
http://www.vupen.com/english/advisories/2006/1736 Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/30055
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:ibm:websphere_application_server:5.0.0:*:*:*:*:*:*:*
cpe:2.3:a:ibm:websphere_application_server:5.0.1:*:*:*:*:*:*:*
cpe:2.3:a:ibm:websphere_application_server:5.0.2:*:*:*:*:*:*:*
cpe:2.3:a:ibm:websphere_application_server:5.1.0:*:*:*:*:*:*:*
cpe:2.3:a:ibm:websphere_application_server:5.1.0.2:*:*:*:*:*:*:*
cpe:2.3:a:ibm:websphere_application_server:5.1.0.3:*:*:*:*:*:*:*
cpe:2.3:a:ibm:websphere_application_server:5.1.0.4:*:*:*:*:*:*:*
cpe:2.3:a:ibm:websphere_application_server:5.1.0.5:*:*:*:*:*:*:*
cpe:2.3:a:ibm:websphere_application_server:5.1.1:*:*:*:*:*:*:*
cpe:2.3:a:ibm:websphere_application_server:5.1.1.1:*:*:*:*:*:*:*
cpe:2.3:a:ibm:websphere_application_server:5.1.1.10:*:*:*:*:*:*:*
cpe:2.3:a:ibm:websphere_application_server:5.1.1.11:*:*:*:*:*:*:*
cpe:2.3:a:ibm:websphere_application_server:6.0.2:*:*:*:*:*:*:*
cpe:2.3:a:ibm:websphere_application_server:6.0.2.1:*:*:*:*:*:*:*
cpe:2.3:a:ibm:websphere_application_server:6.0.2.2:*:*:*:*:*:*:*
cpe:2.3:a:ibm:websphere_application_server:6.0.2.3:*:*:*:*:*:*:*
cpe:2.3:a:ibm:websphere_application_server:6.0.2.4:*:*:*:*:*:*:*
cpe:2.3:a:ibm:websphere_application_server:6.0.2.5:*:*:*:*:*:*:*
cpe:2.3:a:ibm:websphere_application_server:6.0.2.6:*:*:*:*:*:*:*
cpe:2.3:a:ibm:websphere_application_server:6.0.2.7:*:*:*:*:*:*:*

History

21 Nov 2024, 00:11

Type Values Removed Values Added
References () http://archives.neohapsis.com/archives/bugtraq/2006-05/0175.html - Patch () http://archives.neohapsis.com/archives/bugtraq/2006-05/0175.html - Patch
References () http://secunia.com/advisories/20032 - Patch, Vendor Advisory () http://secunia.com/advisories/20032 - Patch, Vendor Advisory
References () http://securityreason.com/securityalert/910 - () http://securityreason.com/securityalert/910 -
References () http://securitytracker.com/id?1017170 - () http://securitytracker.com/id?1017170 -
References () http://www-1.ibm.com/support/docview.wss?rs=0&dc=DB550&q1=PK16492&uid=swg1PK22416&loc=en_US&cs=utf-8&lang= - Patch () http://www-1.ibm.com/support/docview.wss?rs=0&dc=DB550&q1=PK16492&uid=swg1PK22416&loc=en_US&cs=utf-8&lang= - Patch
References () http://www-1.ibm.com/support/docview.wss?rs=180&uid=swg24012064 - Patch () http://www-1.ibm.com/support/docview.wss?rs=180&uid=swg24012064 - Patch
References () http://www-1.ibm.com/support/docview.wss?rs=180&uid=swg24012163 - Patch () http://www-1.ibm.com/support/docview.wss?rs=180&uid=swg24012163 - Patch
References () http://www-1.ibm.com/support/search.wss?rs=0&q=PK16602&apar=only - Patch () http://www-1.ibm.com/support/search.wss?rs=0&q=PK16602&apar=only - Patch
References () http://www-1.ibm.com/support/search.wss?rs=0&q=PK26181&apar=only - () http://www-1.ibm.com/support/search.wss?rs=0&q=PK26181&apar=only -
References () http://www.attrition.org/pipermail/vim/2006-November/001112.html - () http://www.attrition.org/pipermail/vim/2006-November/001112.html -
References () http://www.niscc.gov.uk/niscc/docs/re-20061031-00727.pdf?lang=en - () http://www.niscc.gov.uk/niscc/docs/re-20061031-00727.pdf?lang=en -
References () http://www.osvdb.org/25371 - () http://www.osvdb.org/25371 -
References () http://www.securityfocus.com/archive/1/450704/100/0/threaded - () http://www.securityfocus.com/archive/1/450704/100/0/threaded -
References () http://www.securityfocus.com/bid/21018 - () http://www.securityfocus.com/bid/21018 -
References () http://www.vupen.com/english/advisories/2006/1736 - Vendor Advisory () http://www.vupen.com/english/advisories/2006/1736 - Vendor Advisory
References () https://exchange.xforce.ibmcloud.com/vulnerabilities/30055 - () https://exchange.xforce.ibmcloud.com/vulnerabilities/30055 -

Information

Published : 2006-05-17 10:06

Updated : 2024-11-21 00:11


NVD link : CVE-2006-2431

Mitre link : CVE-2006-2431

CVE.ORG link : CVE-2006-2431


JSON object : View

Products Affected

ibm

  • websphere_application_server
CWE
CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')