HTML-injection vulnerability in IBM WebSphere Portal

vendor:

IBM WebSphere Portal

by:

Unknown

7.5

CVSS

HIGH

HTML-injection

CWE

Product Name: IBM WebSphere Portal

Affected Version From: 6.0.1.5 Build Level wp6015_008_01

Affected Version To: Unknown

Patch Exists: NO

Related CWE: Unknown

CPE: a:ibm:websphere_portal:6.0.1.5

Metasploit:

Other Scripts:

Platforms Tested:

Unknown

HTML-injection vulnerability in IBM WebSphere Portal

An authenticated attacker can execute arbitrary script code in the browser of an unsuspecting user, steal authentication credentials, and launch other attacks.

Mitigation:

Apply the vendor's patch or upgrade to a non-vulnerable version.

Source

Exploit-DB raw data:

source: https://www.securityfocus.com/bid/38360/info

IBM WebSphere Portal is prone to an HTML-injection vulnerability because it fails to properly sanitize user-supplied input.

An authenticated attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

IBM WebSphere Portal 6.0.1.5 Build Level wp6015_008_01 is vulnerable; other versions may also be affected. 

The following code can trigger this issue:

" style="position:absolute; top:-100px; left:-100px; width:10000 px; height:10000px; z-index:999;" onmousemove="alert('XSS')"&gt;