Vulnerability Name:

CVE-2014-0917 (CCN-91979)

Assigned:2014-05-08
Published:2014-05-08
Updated:2017-08-29
Summary:Cross-site scripting (XSS) vulnerability in IBM Eclipse Help System (IEHS) in IBM WebSphere Portal 6.1.0 through 6.1.0.6 CF27, 6.1.5 through 6.1.5.3 CF27, 7.0 through 7.0.0.2 CF27, and 8.0 before 8.0.0.1 CF06 allows remote attackers to inject arbitrary web script or HTML via a crafted URL.
CVSS v3 Severity:5.3 Medium (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)
Exploitability Metrics:Attack Vector (AV): Network
Attack Complexity (AC): Low
Privileges Required (PR): None
User Interaction (UI): None
Scope:Scope (S): Unchanged
Impact Metrics:Confidentiality (C): None
Integrity (I): Low
Availibility (A): None
CVSS v2 Severity:4.3 Medium (CVSS v2 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N)
3.7 Low (Temporal CVSS v2 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N/E:H/RL:OF/RC:C)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Medium
Authentication (Au): None
Impact Metrics:Confidentiality (C): None
Integrity (I): Partial
Availibility (A): None
4.3 Medium (CCN CVSS v2 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N)
3.7 Low (CCN Temporal CVSS v2 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N/E:H/RL:OF/RC:C)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Medium
Athentication (Au): None
Impact Metrics:Confidentiality (C): None
Integrity (I): Partial
Availibility (A): None
Vulnerability Type:CWE-79
Vulnerability Consequences:Cross-Site Scripting
References:Source: MITRE
Type: CNA
CVE-2014-0917

Source: AIXAPAR
Type: UNKNOWN
PI14125

Source: CCN
Type: IBM Security Bulletin 1670753
Fix available for security vulnerabilities related to IEHS in IBM WebSphere Portal (multiple CVEs)

Source: CONFIRM
Type: Vendor Advisory
http://www-01.ibm.com/support/docview.wss?uid=swg21670753

Source: CCN
Type: IBM Security Bulletin 1681229
Fix available for security vulnerabilities related to IEHS in IBM Sametime Meetings and Proxy version 9 (multiple CVEs)

Source: BID
Type: UNKNOWN
67339

Source: CCN
Type: BID-67339
IBM Eclipse Help System CVE-2014-0917 Cross Site Scripting Vulnerability

Source: XF
Type: UNKNOWN
ibm-iehs-cve20140917-xss(91979)

Source: XF
Type: UNKNOWN
ibm-iehs-cve20140917-xss(91979)

Source: CCN
Type: Packet Storm Security [05-10-2015]
IBM Eclipse Help System (IEHS) Cross Site Scripting

Vulnerable Configuration:Configuration 1:
  • cpe:/a:ibm:websphere_portal:6.1.0.0:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:websphere_portal:6.1.0.1:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:websphere_portal:6.1.0.2:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:websphere_portal:6.1.0.3:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:websphere_portal:6.1.0.4:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:websphere_portal:6.1.0.5:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:websphere_portal:6.1.0.6:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:websphere_portal:6.1.5.0:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:websphere_portal:6.1.5.1:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:websphere_portal:6.1.5.2:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:websphere_portal:6.1.5.3:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:websphere_portal:7.0.0.0:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:websphere_portal:7.0.0.0:cf001:*:*:*:*:*:*
  • OR cpe:/a:ibm:websphere_portal:7.0.0.1:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:websphere_portal:7.0.0.1:cf002:*:*:*:*:*:*
  • OR cpe:/a:ibm:websphere_portal:7.0.0.1:cf003:*:*:*:*:*:*
  • OR cpe:/a:ibm:websphere_portal:7.0.0.1:cf004:*:*:*:*:*:*
  • OR cpe:/a:ibm:websphere_portal:7.0.0.1:cf005:*:*:*:*:*:*
  • OR cpe:/a:ibm:websphere_portal:7.0.0.1:cf006:*:*:*:*:*:*
  • OR cpe:/a:ibm:websphere_portal:7.0.0.1:cf007:*:*:*:*:*:*
  • OR cpe:/a:ibm:websphere_portal:7.0.0.1:cf008:*:*:*:*:*:*
  • OR cpe:/a:ibm:websphere_portal:7.0.0.1:cf009:*:*:*:*:*:*
  • OR cpe:/a:ibm:websphere_portal:7.0.0.1:cf010:*:*:*:*:*:*
  • OR cpe:/a:ibm:websphere_portal:7.0.0.1:cf019:*:*:*:*:*:*
  • OR cpe:/a:ibm:websphere_portal:7.0.0.2:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:websphere_portal:7.0.0.2:cf011:*:*:*:*:*:*
  • OR cpe:/a:ibm:websphere_portal:7.0.0.2:cf012:*:*:*:*:*:*
  • OR cpe:/a:ibm:websphere_portal:7.0.0.2:cf013:*:*:*:*:*:*
  • OR cpe:/a:ibm:websphere_portal:7.0.0.2:cf014:*:*:*:*:*:*
  • OR cpe:/a:ibm:websphere_portal:7.0.0.2:cf015:*:*:*:*:*:*
  • OR cpe:/a:ibm:websphere_portal:7.0.0.2:cf016:*:*:*:*:*:*
  • OR cpe:/a:ibm:websphere_portal:7.0.0.2:cf017:*:*:*:*:*:*
  • OR cpe:/a:ibm:websphere_portal:7.0.0.2:cf018:*:*:*:*:*:*
  • OR cpe:/a:ibm:websphere_portal:7.0.0.2:cf019:*:*:*:*:*:*
  • OR cpe:/a:ibm:websphere_portal:7.0.0.2:cf020:*:*:*:*:*:*
  • OR cpe:/a:ibm:websphere_portal:7.0.0.2:cf021:*:*:*:*:*:*
  • OR cpe:/a:ibm:websphere_portal:7.0.0.2:cf022:*:*:*:*:*:*
  • OR cpe:/a:ibm:websphere_portal:7.0.0.2:cf23:*:*:*:*:*:*
  • OR cpe:/a:ibm:websphere_portal:7.0.0.2:cf24:*:*:*:*:*:*
  • OR cpe:/a:ibm:websphere_portal:7.0.0.2:cf25:*:*:*:*:*:*
  • OR cpe:/a:ibm:websphere_portal:7.0.0.2:cf26:*:*:*:*:*:*
  • OR cpe:/a:ibm:websphere_portal:7.0.0.2:cf27:*:*:*:*:*:*
  • OR cpe:/a:ibm:websphere_portal:8.0.0.0:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:websphere_portal:8.0.0.0:cf01:*:*:*:*:*:*
  • OR cpe:/a:ibm:websphere_portal:8.0.0.0:cf02:*:*:*:*:*:*
  • OR cpe:/a:ibm:websphere_portal:8.0.0.0:cf03:*:*:*:*:*:*
  • OR cpe:/a:ibm:websphere_portal:8.0.0.0:cf04:*:*:*:*:*:*
  • OR cpe:/a:ibm:websphere_portal:8.0.0.0:cf05:*:*:*:*:*:*
  • OR cpe:/a:ibm:websphere_portal:8.0.0.1:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:websphere_portal:8.0.0.1:cf04:*:*:*:*:*:*
  • OR cpe:/a:ibm:websphere_portal:8.0.0.1:cf05:*:*:*:*:*:*

  • Configuration CCN 1:
  • cpe:/a:ibm:websphere_portal:8.0:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:websphere_portal:7.0.0.0:-:*:*:*:*:*:*
  • OR cpe:/a:ibm:websphere_portal:6.1.0:*:*:*:*:*:*:*
  • AND
  • cpe:/a:ibm:websphere_portal:7.0:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:eclipse_help_system:3.4.3:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:sametime:9.0.0.0:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:sametime:9.0.0.1:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:websphere_portal:6.1:*:*:*:*:*:*:*

  • * Denotes that component is vulnerable
    BACK
    ibm websphere portal 6.1.0.0
    ibm websphere portal 6.1.0.1
    ibm websphere portal 6.1.0.2
    ibm websphere portal 6.1.0.3
    ibm websphere portal 6.1.0.4
    ibm websphere portal 6.1.0.5
    ibm websphere portal 6.1.0.6
    ibm websphere portal 6.1.5.0
    ibm websphere portal 6.1.5.1
    ibm websphere portal 6.1.5.2
    ibm websphere portal 6.1.5.3
    ibm websphere portal 7.0.0.0
    ibm websphere portal 7.0.0.0 cf001
    ibm websphere portal 7.0.0.1
    ibm websphere portal 7.0.0.1 cf002
    ibm websphere portal 7.0.0.1 cf003
    ibm websphere portal 7.0.0.1 cf004
    ibm websphere portal 7.0.0.1 cf005
    ibm websphere portal 7.0.0.1 cf006
    ibm websphere portal 7.0.0.1 cf007
    ibm websphere portal 7.0.0.1 cf008
    ibm websphere portal 7.0.0.1 cf009
    ibm websphere portal 7.0.0.1 cf010
    ibm websphere portal 7.0.0.1 cf019
    ibm websphere portal 7.0.0.2
    ibm websphere portal 7.0.0.2 cf011
    ibm websphere portal 7.0.0.2 cf012
    ibm websphere portal 7.0.0.2 cf013
    ibm websphere portal 7.0.0.2 cf014
    ibm websphere portal 7.0.0.2 cf015
    ibm websphere portal 7.0.0.2 cf016
    ibm websphere portal 7.0.0.2 cf017
    ibm websphere portal 7.0.0.2 cf018
    ibm websphere portal 7.0.0.2 cf019
    ibm websphere portal 7.0.0.2 cf020
    ibm websphere portal 7.0.0.2 cf021
    ibm websphere portal 7.0.0.2 cf022
    ibm websphere portal 7.0.0.2 cf23
    ibm websphere portal 7.0.0.2 cf24
    ibm websphere portal 7.0.0.2 cf25
    ibm websphere portal 7.0.0.2 cf26
    ibm websphere portal 7.0.0.2 cf27
    ibm websphere portal 8.0.0.0
    ibm websphere portal 8.0.0.0 cf01
    ibm websphere portal 8.0.0.0 cf02
    ibm websphere portal 8.0.0.0 cf03
    ibm websphere portal 8.0.0.0 cf04
    ibm websphere portal 8.0.0.0 cf05
    ibm websphere portal 8.0.0.1
    ibm websphere portal 8.0.0.1 cf04
    ibm websphere portal 8.0.0.1 cf05
    ibm websphere portal 8.0
    ibm websphere portal 7.0.0.0 -
    ibm websphere portal 6.1.0
    ibm websphere portal 7.0
    ibm eclipse help system 3.4.3
    ibm sametime 9.0.0.0
    ibm sametime 9.0.0.1
    ibm websphere portal 6.1