CVE-2013-4065

Cross-site scripting (XSS) vulnerability in iNotes in IBM Domino 8.5.x before 8.5.3 FP6 and 9.0.x before 9.0.1, when ultra-light mode is enabled, allows remote attackers to inject arbitrary web script or HTML via active content in an e-mail message, aka SPR TCLE98ZKRP.

CVSS v2.0 2.6 LOW

2.6^/10

CVSS v2.0 : LOW

Vector : AV:N/AC:H/Au:N/C:N/I:P/A:N

Exploitability : 4.9 / Impact : 2.9

Access Vector NETWORK

Access Complexity HIGH

Authentication NONE

Confidentiality Impact NONE

Integrity Impact PARTIAL

Availability Impact NONE

References

Link	Resource
http://www-01.ibm.com/support/docview.wss?uid=swg21659959	Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/86596

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:ibm:lotus_domino:8.5.3.0:::::::*
	cpe:2.3:a:ibm:lotus_domino:8.5.3.1:::::::*
	cpe:2.3:a:ibm:lotus_domino:8.5.3.2:::::::*
	cpe:2.3:a:ibm:lotus_domino:8.5.3.3:::::::*
	cpe:2.3:a:ibm:lotus_domino:8.5.3.4:::::::*
	cpe:2.3:a:ibm:lotus_domino:8.5.3.5:::::::*
	cpe:2.3:a:ibm:lotus_domino:9.0.0.0:::::::*
	cpe:2.3:a:ibm:lotus_inotes:8.5.3.0:::::::*
	cpe:2.3:a:ibm:lotus_inotes:8.5.3.1:::::::*
	cpe:2.3:a:ibm:lotus_inotes:8.5.3.2:::::::*
	cpe:2.3:a:ibm:lotus_inotes:8.5.3.3:::::::*
	cpe:2.3:a:ibm:lotus_inotes:8.5.3.4:::::::*
	cpe:2.3:a:ibm:lotus_inotes:8.5.3.5:::::::*
	cpe:2.3:a:ibm:lotus_inotes:9.0.0.0:::::::*

History

No history.

Information

Published : 2013-12-21 14:22

Updated : 2024-02-28 12:00

NVD link : CVE-2013-4065

Mitre link : CVE-2013-4065

CVE.ORG link : CVE-2013-4065

JSON object : View

Products Affected

ibm

lotus_domino
lotus_inotes

CWE

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

{"id": "CVE-2013-4065", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 2.6, "accessVector": "NETWORK", "vectorString": "AV:N/AC:H/Au:N/C:N/I:P/A:N", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "HIGH", "availabilityImpact": "NONE", "confidentialityImpact": "NONE"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "LOW", "obtainAllPrivilege": false, "exploitabilityScore": 4.9, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": true}]}, "published": "2013-12-21T14:22:56.783", "references": [{"url": "http://www-01.ibm.com/support/docview.wss?uid=swg21659959", "tags": ["Vendor Advisory"], "source": "psirt@us.ibm.com"}, {"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/86596", "source": "psirt@us.ibm.com"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-79"}]}], "descriptions": [{"lang": "en", "value": "Cross-site scripting (XSS) vulnerability in iNotes in IBM Domino 8.5.x before 8.5.3 FP6 and 9.0.x before 9.0.1, when ultra-light mode is enabled, allows remote attackers to inject arbitrary web script or HTML via active content in an e-mail message, aka SPR TCLE98ZKRP."}, {"lang": "es", "value": "Vulnerabilidad cross-site scripting (XSS) en iNotes de IBM Domino 8.5.x anteriores a 8.5.3 FP6 y 9.0.x anteriores a 9.0.1, cuando el modo ultra-light est\u00e1 activado, permite a atacantes remotos inyectar script web o HTML a trav\u00e9s de contenido activo en un mensaje de email, tambien conocido como SPR TCLE98ZKRP."}], "lastModified": "2017-08-29T01:33:35.090", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:ibm:lotus_domino:8.5.3.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "350ACC22-669F-4429-A525-36F56EF9678C"}, {"criteria": "cpe:2.3:a:ibm:lotus_domino:8.5.3.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "3C068055-FB7A-4AFB-AF29-28238ECF126F"}, {"criteria": "cpe:2.3:a:ibm:lotus_domino:8.5.3.2:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "1ACB4B2C-CCE1-4A0A-B962-B8C208869589"}, {"criteria": "cpe:2.3:a:ibm:lotus_domino:8.5.3.3:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "BC1A8676-B2CA-49FF-A43E-EAC62170BF82"}, {"criteria": "cpe:2.3:a:ibm:lotus_domino:8.5.3.4:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "71ADC0C5-36E9-426E-B302-56804B1800BB"}, {"criteria": "cpe:2.3:a:ibm:lotus_domino:8.5.3.5:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "24863689-9472-4C56-B3A8-3053494437C1"}, {"criteria": "cpe:2.3:a:ibm:lotus_domino:9.0.0.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "7025B610-6988-4A78-B0ED-6FB728AA6C28"}, {"criteria": "cpe:2.3:a:ibm:lotus_inotes:8.5.3.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "76D0D493-1BFD-4054-BDB0-F338BFAFDC5F"}, {"criteria": "cpe:2.3:a:ibm:lotus_inotes:8.5.3.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "F088F719-F4BE-4B49-B022-96D43664155B"}, {"criteria": "cpe:2.3:a:ibm:lotus_inotes:8.5.3.2:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "B7F797B7-C3EA-4A12-8D69-217FBD4B9EB1"}, {"criteria": "cpe:2.3:a:ibm:lotus_inotes:8.5.3.3:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "AFCA4DA1-302C-42AD-9317-DC733A17696B"}, {"criteria": "cpe:2.3:a:ibm:lotus_inotes:8.5.3.4:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "B102407C-3CCE-45A5-A3A2-9C24D5F4866A"}, {"criteria": "cpe:2.3:a:ibm:lotus_inotes:8.5.3.5:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "577AA3FA-31BA-429C-8CE6-B3776F5CF857"}, {"criteria": "cpe:2.3:a:ibm:lotus_inotes:9.0.0.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "F9B79C2F-8633-47A2-ADB5-FEB0EEB10B90"}], "operator": "OR"}]}], "sourceIdentifier": "psirt@us.ibm.com"}