CVE-2013-6322

Cross-site scripting (XSS) vulnerability in Sterling Order Management in IBM Sterling Selling and Fulfillment Suite 8.0 before HF128 and 8.5 before HF93 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.

CVSS v2.0 3.5 LOW

3.5^/10

CVSS v2.0 : LOW

Vector : AV:N/AC:M/Au:S/C:N/I:P/A:N

Exploitability : 6.8 / Impact : 2.9

Access Vector NETWORK

Access Complexity MEDIUM

Authentication SINGLE

Confidentiality Impact NONE

Integrity Impact PARTIAL

Availability Impact NONE

References

Link	Resource
http://www-01.ibm.com/support/docview.wss?uid=swg1IC97745
http://www-01.ibm.com/support/docview.wss?uid=swg21656906	Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/88902
http://www-01.ibm.com/support/docview.wss?uid=swg1IC97745
http://www-01.ibm.com/support/docview.wss?uid=swg21656906	Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/88902

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:ibm:sterling_selling_and_fulfillment_foundation:8.0:::::::*
	cpe:2.3:a:ibm:sterling_selling_and_fulfillment_foundation:8.5:::::::*

History

21 Nov 2024, 01:59

Type	Values Removed	Values Added
References	~~() http://www-01.ibm.com/support/docview.wss?uid=swg1IC97745 -~~	() http://www-01.ibm.com/support/docview.wss?uid=swg1IC97745 -
References	~~() http://www-01.ibm.com/support/docview.wss?uid=swg21656906 - Vendor Advisory~~	() http://www-01.ibm.com/support/docview.wss?uid=swg21656906 - Vendor Advisory
References	~~() https://exchange.xforce.ibmcloud.com/vulnerabilities/88902 -~~	() https://exchange.xforce.ibmcloud.com/vulnerabilities/88902 -

Information

Published : 2013-11-28 04:37

Updated : 2024-11-21 01:59

NVD link : CVE-2013-6322

Mitre link : CVE-2013-6322

CVE.ORG link : CVE-2013-6322

JSON object : View

Products Affected

ibm

sterling_selling_and_fulfillment_foundation

CWE

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

{"id": "CVE-2013-6322", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 3.5, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:S/C:N/I:P/A:N", "authentication": "SINGLE", "integrityImpact": "PARTIAL", "accessComplexity": "MEDIUM", "availabilityImpact": "NONE", "confidentialityImpact": "NONE"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "LOW", "obtainAllPrivilege": false, "exploitabilityScore": 6.8, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": true}]}, "published": "2013-11-28T04:37:39.747", "references": [{"url": "http://www-01.ibm.com/support/docview.wss?uid=swg1IC97745", "source": "psirt@us.ibm.com"}, {"url": "http://www-01.ibm.com/support/docview.wss?uid=swg21656906", "tags": ["Vendor Advisory"], "source": "psirt@us.ibm.com"}, {"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/88902", "source": "psirt@us.ibm.com"}, {"url": "http://www-01.ibm.com/support/docview.wss?uid=swg1IC97745", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://www-01.ibm.com/support/docview.wss?uid=swg21656906", "tags": ["Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/88902", "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-79"}]}], "descriptions": [{"lang": "en", "value": "Cross-site scripting (XSS) vulnerability in Sterling Order Management in IBM Sterling Selling and Fulfillment Suite 8.0 before HF128 and 8.5 before HF93 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors."}, {"lang": "es", "value": "Vulnerabilidad de XSS en Sterling Order Management en IBM Sterling Selling and Fulfillment Suite 8.0 anterior a la versi\u00f3n HF128 y 8.5 anterior a HF93 permite a usuarios remotos autenticados inyectar script web o HTML arbitrario a trav\u00e9s de vectores sin especificar."}], "lastModified": "2024-11-21T01:59:00.140", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:ibm:sterling_selling_and_fulfillment_foundation:8.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "0D852E36-8F6C-42FB-8644-40AAB242F2FC"}, {"criteria": "cpe:2.3:a:ibm:sterling_selling_and_fulfillment_foundation:8.5:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "F67E9BBD-95B4-46E5-A980-72BFDFDAF9B6"}], "operator": "OR"}]}], "sourceIdentifier": "psirt@us.ibm.com"}