ID

VAR-201709-0612


CVE

CVE-2017-1591


TITLE

IBM WebSphere DataPower Appliances cross-site scripting vulnerability

Trust: 1.2

sources: CNVD: CNVD-2017-34841 // CNNVD: CNNVD-201709-1258

DESCRIPTION

IBM WebSphere DataPower Appliances 7.0.0 through 7.6 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 132368. Vendors have confirmed this vulnerability IBM X-Force ID: 132368 It is released as.Information may be obtained and information may be altered. IBMWebSphereDataPowerAppliances is a set of network equipment from IBM Corporation of the United States. The device is designed to simplify, secure, and accelerate the deployment of XML and Web services in SOA. A remote attacker could exploit this vulnerability to inject arbitrary JavaScript code into the WebUI. An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and launch other attacks

Trust: 2.52

sources: NVD: CVE-2017-1591 // JVNDB: JVNDB-2017-008520 // CNVD: CNVD-2017-34841 // BID: 101021 // VULHUB: VHN-106779

IOT TAXONOMY

category:['Network device']sub_category: -

Trust: 0.6

sources: CNVD: CNVD-2017-34841

AFFECTED PRODUCTS

vendor:ibmmodel:datapower gatewayscope:eqversion:7.0.0.6

Trust: 1.6

vendor:ibmmodel:datapower gatewayscope:eqversion:7.0.0.4

Trust: 1.6

vendor:ibmmodel:datapower gatewayscope:eqversion:7.0.0.3

Trust: 1.6

vendor:ibmmodel:datapower gatewayscope:eqversion:7.0.0.7

Trust: 1.6

vendor:ibmmodel:datapower gatewayscope:eqversion:7.0.0.0

Trust: 1.6

vendor:ibmmodel:datapower gatewayscope:eqversion:7.0.0.1

Trust: 1.6

vendor:ibmmodel:datapower gatewayscope:eqversion:7.0.0.8

Trust: 1.6

vendor:ibmmodel:datapower gatewayscope:eqversion:7.0.0.5

Trust: 1.6

vendor:ibmmodel:datapower gatewayscope:eqversion:7.0.0.9

Trust: 1.6

vendor:ibmmodel:datapower gatewayscope:eqversion:7.0.0.2

Trust: 1.6

vendor:ibmmodel:datapower gatewayscope:eqversion:7.5.2.2

Trust: 1.0

vendor:ibmmodel:datapower gatewayscope:eqversion:7.5.1.6

Trust: 1.0

vendor:ibmmodel:datapower gatewayscope:eqversion:7.2.0.14

Trust: 1.0

vendor:ibmmodel:datapower gatewayscope:eqversion:7.5.1.8

Trust: 1.0

vendor:ibmmodel:datapower gatewayscope:eqversion:7.1.0.1

Trust: 1.0

vendor:ibmmodel:datapower gatewayscope:eqversion:7.1.0.15

Trust: 1.0

vendor:ibmmodel:datapower gatewayscope:eqversion:7.2.0.15

Trust: 1.0

vendor:ibmmodel:datapower gatewayscope:eqversion:7.0.0.14

Trust: 1.0

vendor:ibmmodel:datapower gatewayscope:eqversion:7.5.2.4

Trust: 1.0

vendor:ibmmodel:datapower gatewayscope:eqversion:7.2.0.9

Trust: 1.0

vendor:ibmmodel:datapower gatewayscope:eqversion:7.0.0.17

Trust: 1.0

vendor:ibmmodel:datapower gatewayscope:eqversion:7.1.0.14

Trust: 1.0

vendor:ibmmodel:datapower gatewayscope:eqversion:7.5.0.9

Trust: 1.0

vendor:ibmmodel:datapower gatewayscope:eqversion:7.0.0.11

Trust: 1.0

vendor:ibmmodel:datapower gatewayscope:eqversion:7.5.2.0

Trust: 1.0

vendor:ibmmodel:datapower gatewayscope:eqversion:7.1.0.3

Trust: 1.0

vendor:ibmmodel:datapower gatewayscope:eqversion:7.2.0.2

Trust: 1.0

vendor:ibmmodel:datapower gatewayscope:eqversion:7.5.1.1

Trust: 1.0

vendor:ibmmodel:datapower gatewayscope:eqversion:7.1.0.0

Trust: 1.0

vendor:ibmmodel:datapower gatewayscope:eqversion:7.1.0.4

Trust: 1.0

vendor:ibmmodel:datapower gatewayscope:eqversion:7.1.0.16

Trust: 1.0

vendor:ibmmodel:datapower gatewayscope:eqversion:7.2.0.6

Trust: 1.0

vendor:ibmmodel:datapower gatewayscope:eqversion:7.1.0.9

Trust: 1.0

vendor:ibmmodel:datapower gatewayscope:eqversion:7.0.0.15

Trust: 1.0

vendor:ibmmodel:datapower gatewayscope:eqversion:7.1.0.17

Trust: 1.0

vendor:ibmmodel:datapower gatewayscope:eqversion:7.1.0.18

Trust: 1.0

vendor:ibmmodel:datapower gatewayscope:eqversion:7.2.0.11

Trust: 1.0

vendor:ibmmodel:datapower gatewayscope:eqversion:7.5.1.0

Trust: 1.0

vendor:ibmmodel:datapower gatewayscope:eqversion:7.1.0.12

Trust: 1.0

vendor:ibmmodel:datapower gatewayscope:eqversion:7.5.0.2

Trust: 1.0

vendor:ibmmodel:datapower gatewayscope:eqversion:7.5.0.4

Trust: 1.0

vendor:ibmmodel:datapower gatewayscope:eqversion:7.2.0.5

Trust: 1.0

vendor:ibmmodel:datapower gatewayscope:eqversion:7.5.2.1

Trust: 1.0

vendor:ibmmodel:datapower gatewayscope:eqversion:7.1.0.10

Trust: 1.0

vendor:ibmmodel:datapower gatewayscope:eqversion:7.5.2.5

Trust: 1.0

vendor:ibmmodel:datapower gatewayscope:eqversion:7.0.0.10

Trust: 1.0

vendor:ibmmodel:datapower gatewayscope:eqversion:7.2.0.1

Trust: 1.0

vendor:ibmmodel:datapower gatewayscope:eqversion:7.5.0.3

Trust: 1.0

vendor:ibmmodel:datapower gatewayscope:eqversion:7.1.0.2

Trust: 1.0

vendor:ibmmodel:datapower gatewayscope:eqversion:7.2.0.8

Trust: 1.0

vendor:ibmmodel:datapower gatewayscope:eqversion:7.5.0.6

Trust: 1.0

vendor:ibmmodel:datapower gatewayscope:eqversion:7.2.0.3

Trust: 1.0

vendor:ibmmodel:datapower gatewayscope:eqversion:7.5.1.7

Trust: 1.0

vendor:ibmmodel:datapower gatewayscope:eqversion:7.2.0.10

Trust: 1.0

vendor:ibmmodel:datapower gatewayscope:eqversion:7.2.0.4

Trust: 1.0

vendor:ibmmodel:datapower gatewayscope:eqversion:7.5.0.5

Trust: 1.0

vendor:ibmmodel:datapower gatewayscope:eqversion:7.5.0.0

Trust: 1.0

vendor:ibmmodel:datapower gatewayscope:eqversion:7.2.0.0

Trust: 1.0

vendor:ibmmodel:datapower gatewayscope:eqversion:7.5.2.6

Trust: 1.0

vendor:ibmmodel:datapower gatewayscope:eqversion:7.5.2.7

Trust: 1.0

vendor:ibmmodel:datapower gatewayscope:eqversion:7.1.0.11

Trust: 1.0

vendor:ibmmodel:datapower gatewayscope:eqversion:7.2.0.7

Trust: 1.0

vendor:ibmmodel:datapower gatewayscope:eqversion:7.5.0.8

Trust: 1.0

vendor:ibmmodel:datapower gatewayscope:eqversion:7.0.0.19

Trust: 1.0

vendor:ibmmodel:datapower gatewayscope:eqversion:7.6.0.0

Trust: 1.0

vendor:ibmmodel:datapower gatewayscope:eqversion:7.1.0.7

Trust: 1.0

vendor:ibmmodel:datapower gatewayscope:eqversion:7.5.1.2

Trust: 1.0

vendor:ibmmodel:datapower gatewayscope:eqversion:7.1.0.8

Trust: 1.0

vendor:ibmmodel:datapower gatewayscope:eqversion:7.5.2.3

Trust: 1.0

vendor:ibmmodel:datapower gatewayscope:eqversion:7.0.0.12

Trust: 1.0

vendor:ibmmodel:datapower gatewayscope:eqversion:7.0.0.16

Trust: 1.0

vendor:ibmmodel:datapower gatewayscope:eqversion:7.1.0.13

Trust: 1.0

vendor:ibmmodel:datapower gatewayscope:eqversion:7.2.0.12

Trust: 1.0

vendor:ibmmodel:datapower gatewayscope:eqversion:7.1.0.6

Trust: 1.0

vendor:ibmmodel:datapower gatewayscope:eqversion:7.0.0.18

Trust: 1.0

vendor:ibmmodel:datapower gatewayscope:eqversion:7.5.0.1

Trust: 1.0

vendor:ibmmodel:datapower gatewayscope:eqversion:7.2.0.13

Trust: 1.0

vendor:ibmmodel:datapower gatewayscope:eqversion:7.5.1.3

Trust: 1.0

vendor:ibmmodel:datapower gatewayscope:eqversion:7.0.0.13

Trust: 1.0

vendor:ibmmodel:datapower gatewayscope:eqversion:7.1.0.5

Trust: 1.0

vendor:ibmmodel:datapower gatewayscope:eqversion:7.5.1.4

Trust: 1.0

vendor:ibmmodel:datapower gatewayscope:eqversion:7.5.0.7

Trust: 1.0

vendor:ibmmodel:datapower gatewayscope:eqversion:7.5.1.5

Trust: 1.0

vendor:ibmmodel:datapower gatewayscope:eqversion:7.5.2.8

Trust: 1.0

vendor:ibmmodel:datapower gatewayscope: - version: -

Trust: 0.8

vendor:ibmmodel:websphere datapower appliancesscope:gteversion:7.0.0<=7.6

Trust: 0.6

vendor:ibmmodel:datapower gatewaysscope:eqversion:7.0

Trust: 0.3

vendor:ibmmodel:datapower gatewaysscope:eqversion:7.6.0.0

Trust: 0.3

vendor:ibmmodel:datapower gatewaysscope:eqversion:7.5.2.8

Trust: 0.3

vendor:ibmmodel:datapower gatewaysscope:eqversion:7.5.2.2

Trust: 0.3

vendor:ibmmodel:datapower gatewaysscope:eqversion:7.5.2.1

Trust: 0.3

vendor:ibmmodel:datapower gatewaysscope:eqversion:7.5.2.0

Trust: 0.3

vendor:ibmmodel:datapower gatewaysscope:eqversion:7.5.1.8

Trust: 0.3

vendor:ibmmodel:datapower gatewaysscope:eqversion:7.5.1.4

Trust: 0.3

vendor:ibmmodel:datapower gatewaysscope:eqversion:7.5.1.3

Trust: 0.3

vendor:ibmmodel:datapower gatewaysscope:eqversion:7.5.1.2

Trust: 0.3

vendor:ibmmodel:datapower gatewaysscope:eqversion:7.5.1.1

Trust: 0.3

vendor:ibmmodel:datapower gatewaysscope:eqversion:7.5.1.0

Trust: 0.3

vendor:ibmmodel:datapower gatewaysscope:eqversion:7.5.0.9

Trust: 0.3

vendor:ibmmodel:datapower gatewaysscope:eqversion:7.5.0.5

Trust: 0.3

vendor:ibmmodel:datapower gatewaysscope:eqversion:7.5.0.4

Trust: 0.3

vendor:ibmmodel:datapower gatewaysscope:eqversion:7.5.0.3

Trust: 0.3

vendor:ibmmodel:datapower gatewaysscope:eqversion:7.5.0.2

Trust: 0.3

vendor:ibmmodel:datapower gatewaysscope:eqversion:7.5.0.1

Trust: 0.3

vendor:ibmmodel:datapower gatewaysscope:eqversion:7.5.0.0

Trust: 0.3

vendor:ibmmodel:datapower gatewaysscope:eqversion:7.2.0.9

Trust: 0.3

vendor:ibmmodel:datapower gatewaysscope:eqversion:7.2.0.8

Trust: 0.3

vendor:ibmmodel:datapower gatewaysscope:eqversion:7.2.0.6

Trust: 0.3

vendor:ibmmodel:datapower gatewaysscope:eqversion:7.2.0.5

Trust: 0.3

vendor:ibmmodel:datapower gatewaysscope:eqversion:7.2.0.4

Trust: 0.3

vendor:ibmmodel:datapower gatewaysscope:eqversion:7.2.0.3

Trust: 0.3

vendor:ibmmodel:datapower gatewaysscope:eqversion:7.2.0.2

Trust: 0.3

vendor:ibmmodel:datapower gatewaysscope:eqversion:7.2.0.15

Trust: 0.3

vendor:ibmmodel:datapower gatewaysscope:eqversion:7.2.0.11

Trust: 0.3

vendor:ibmmodel:datapower gatewaysscope:eqversion:7.2.0.10

Trust: 0.3

vendor:ibmmodel:datapower gatewaysscope:eqversion:7.2.0.1

Trust: 0.3

vendor:ibmmodel:datapower gatewaysscope:eqversion:7.2.0.0

Trust: 0.3

vendor:ibmmodel:datapower gatewaysscope:eqversion:7.1.0.8

Trust: 0.3

vendor:ibmmodel:datapower gatewaysscope:eqversion:7.1.0.7

Trust: 0.3

vendor:ibmmodel:datapower gatewaysscope:eqversion:7.1.0.6

Trust: 0.3

vendor:ibmmodel:datapower gatewaysscope:eqversion:7.1.0.5

Trust: 0.3

vendor:ibmmodel:datapower gatewaysscope:eqversion:7.1.0.18

Trust: 0.3

vendor:ibmmodel:datapower gatewaysscope:eqversion:7.1.0.14

Trust: 0.3

vendor:ibmmodel:datapower gatewaysscope:eqversion:7.1.0.13

Trust: 0.3

vendor:ibmmodel:datapower gatewaysscope:eqversion:7.1.0.12

Trust: 0.3

vendor:ibmmodel:datapower gatewaysscope:eqversion:7.1.0.11

Trust: 0.3

vendor:ibmmodel:datapower gatewaysscope:eqversion:7.1.0.10

Trust: 0.3

vendor:ibmmodel:datapower gatewaysscope:eqversion:7.1.0.0

Trust: 0.3

vendor:ibmmodel:datapower gatewaysscope:eqversion:7.0.0.9

Trust: 0.3

vendor:ibmmodel:datapower gatewaysscope:eqversion:7.0.0.8

Trust: 0.3

vendor:ibmmodel:datapower gatewaysscope:eqversion:7.0.0.19

Trust: 0.3

vendor:ibmmodel:datapower gatewaysscope:eqversion:7.0.0.17

Trust: 0.3

vendor:ibmmodel:datapower gatewaysscope:eqversion:7.0.0.16

Trust: 0.3

vendor:ibmmodel:datapower gatewaysscope:eqversion:7.0.0.15

Trust: 0.3

vendor:ibmmodel:datapower gatewaysscope:eqversion:7.0.0.14

Trust: 0.3

vendor:ibmmodel:datapower gatewaysscope:eqversion:7.0.0.13

Trust: 0.3

vendor:ibmmodel:datapower gatewaysscope:eqversion:7.0.0.12

Trust: 0.3

vendor:ibmmodel:datapower gatewaysscope:eqversion:7.0.0.11

Trust: 0.3

vendor:ibmmodel:datapower gatewaysscope:eqversion:7.0.0.10

Trust: 0.3

vendor:ibmmodel:datapower gatewaysscope:neversion:7.6.0.1

Trust: 0.3

vendor:ibmmodel:datapower gatewaysscope:neversion:7.5.2.9

Trust: 0.3

vendor:ibmmodel:datapower gatewaysscope:neversion:7.5.1.9

Trust: 0.3

vendor:ibmmodel:datapower gatewaysscope:neversion:7.5.0.10

Trust: 0.3

vendor:ibmmodel:datapower gatewaysscope:neversion:7.2.0.16

Trust: 0.3

vendor:ibmmodel:datapower gatewaysscope:neversion:7.1.0.19

Trust: 0.3

vendor:ibmmodel:datapower gatewaysscope:neversion:7.0.0.20

Trust: 0.3

sources: CNVD: CNVD-2017-34841 // BID: 101021 // JVNDB: JVNDB-2017-008520 // CNNVD: CNNVD-201709-1258 // NVD: CVE-2017-1591

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2017-1591
value: MEDIUM

Trust: 1.0

NVD: CVE-2017-1591
value: MEDIUM

Trust: 0.8

CNVD: CNVD-2017-34841
value: MEDIUM

Trust: 0.6

CNNVD: CNNVD-201709-1258
value: MEDIUM

Trust: 0.6

VULHUB: VHN-106779
value: MEDIUM

Trust: 0.1

nvd@nist.gov: CVE-2017-1591
severity: MEDIUM
baseScore: 4.3
vectorString: AV:N/AC:M/AU:N/C:N/I:P/A:N
accessVector: NETWORK
accessComplexity: MEDIUM
authentication: NONE
confidentialityImpact: NONE
integrityImpact: PARTIAL
availabilityImpact: NONE
exploitabilityScore: 8.6
impactScore: 2.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.8

CNVD: CNVD-2017-34841
severity: MEDIUM
baseScore: 4.3
vectorString: AV:N/AC:M/AU:N/C:N/I:P/A:N
accessVector: NETWORK
accessComplexity: MEDIUM
authentication: NONE
confidentialityImpact: NONE
integrityImpact: PARTIAL
availabilityImpact: NONE
exploitabilityScore: 8.6
impactScore: 2.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.6

VULHUB: VHN-106779
severity: MEDIUM
baseScore: 4.3
vectorString: AV:N/AC:M/AU:N/C:N/I:P/A:N
accessVector: NETWORK
accessComplexity: MEDIUM
authentication: NONE
confidentialityImpact: NONE
integrityImpact: PARTIAL
availabilityImpact: NONE
exploitabilityScore: 8.6
impactScore: 2.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.1

nvd@nist.gov: CVE-2017-1591
baseSeverity: MEDIUM
baseScore: 6.1
vectorString: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: REQUIRED
scope: CHANGED
confidentialityImpact: LOW
integrityImpact: LOW
availabilityImpact: NONE
exploitabilityScore: 2.8
impactScore: 2.7
version: 3.0

Trust: 1.8

sources: CNVD: CNVD-2017-34841 // VULHUB: VHN-106779 // JVNDB: JVNDB-2017-008520 // CNNVD: CNNVD-201709-1258 // NVD: CVE-2017-1591

PROBLEMTYPE DATA

problemtype:CWE-79

Trust: 1.9

sources: VULHUB: VHN-106779 // JVNDB: JVNDB-2017-008520 // NVD: CVE-2017-1591

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-201709-1258

TYPE

XSS

Trust: 0.6

sources: CNNVD: CNNVD-201709-1258

CONFIGURATIONS

sources: JVNDB: JVNDB-2017-008520

PATCH

title:2008815url:http://www-01.ibm.com/support/docview.wss?uid=swg22008815

Trust: 0.8

title:Patch for IBMWebSphereDataPowerAppliances cross-site scripting vulnerabilityurl:https://www.cnvd.org.cn/patchInfo/show/106575

Trust: 0.6

title:IBM WebSphere DataPower Appliances Fixes for cross-site scripting vulnerabilitiesurl:http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=75169

Trust: 0.6

sources: CNVD: CNVD-2017-34841 // JVNDB: JVNDB-2017-008520 // CNNVD: CNNVD-201709-1258

EXTERNAL IDS

db:NVDid:CVE-2017-1591

Trust: 3.4

db:BIDid:101021

Trust: 2.0

db:JVNDBid:JVNDB-2017-008520

Trust: 0.8

db:CNNVDid:CNNVD-201709-1258

Trust: 0.7

db:CNVDid:CNVD-2017-34841

Trust: 0.6

db:NSFOCUSid:37702

Trust: 0.6

db:VULHUBid:VHN-106779

Trust: 0.1

sources: CNVD: CNVD-2017-34841 // VULHUB: VHN-106779 // BID: 101021 // JVNDB: JVNDB-2017-008520 // CNNVD: CNNVD-201709-1258 // NVD: CVE-2017-1591

REFERENCES

url:http://www.securityfocus.com/bid/101021

Trust: 1.7

url:http://www.ibm.com/support/docview.wss?uid=swg22008815

Trust: 1.7

url:https://exchange.xforce.ibmcloud.com/vulnerabilities/132368

Trust: 1.7

url:http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2017-1591

Trust: 0.8

url:https://nvd.nist.gov/vuln/detail/cve-2017-1591

Trust: 0.8

url:http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2017-1591

Trust: 0.6

url:http://www.nsfocus.net/vulndb/37702

Trust: 0.6

url:http://www.ibm.com/

Trust: 0.3

url:http://www-01.ibm.com/support/docview.wss?uid=swg22008815

Trust: 0.3

sources: CNVD: CNVD-2017-34841 // VULHUB: VHN-106779 // BID: 101021 // JVNDB: JVNDB-2017-008520 // CNNVD: CNNVD-201709-1258 // NVD: CVE-2017-1591

CREDITS

Marc Strbel

Trust: 0.3

sources: BID: 101021

SOURCES

db:CNVDid:CNVD-2017-34841
db:VULHUBid:VHN-106779
db:BIDid:101021
db:JVNDBid:JVNDB-2017-008520
db:CNNVDid:CNNVD-201709-1258
db:NVDid:CVE-2017-1591

LAST UPDATE DATE

2024-11-23T23:08:55.850000+00:00


SOURCES UPDATE DATE

db:CNVDid:CNVD-2017-34841date:2017-11-22T00:00:00
db:VULHUBid:VHN-106779date:2017-10-06T00:00:00
db:BIDid:101021date:2017-09-25T00:00:00
db:JVNDBid:JVNDB-2017-008520date:2017-10-20T00:00:00
db:CNNVDid:CNNVD-201709-1258date:2017-10-09T00:00:00
db:NVDid:CVE-2017-1591date:2024-11-21T03:22:06.867

SOURCES RELEASE DATE

db:CNVDid:CNVD-2017-34841date:2017-11-22T00:00:00
db:VULHUBid:VHN-106779date:2017-09-28T00:00:00
db:BIDid:101021date:2017-09-25T00:00:00
db:JVNDBid:JVNDB-2017-008520date:2017-10-20T00:00:00
db:CNNVDid:CNNVD-201709-1258date:2017-09-27T00:00:00
db:NVDid:CVE-2017-1591date:2017-09-28T01:29:02.793