CVE-2013-6732

2014-02-2221:55:04

CWE-79

[email protected]

web.nvd.nist.gov

ibm cognos

business intelligence

xss

vulnerability

web script

html

remote attackers

nvd

cve-2013-6732

4.3 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

7.3 High

AI Score

Confidence

Low

0.001 Low

EPSS

Percentile

47.3%

JSON

Cross-site scripting (XSS) vulnerability in the server in IBM Cognos Business Intelligence (BI) 8.4.1, 10.1 before IF6, 10.1.1 before IF5, 10.2 before IF7, 10.2.1 before IF4, and 10.2.1.1 before IF4 allows remote attackers to inject arbitrary web script or HTML via an unspecified parameter.

Affected configurations

NVD

Node

ibmcognos_business_intelligenceMatch8.4.1

ibmcognos_business_intelligenceMatch10.1

ibmcognos_business_intelligenceMatch10.1.1

ibmcognos_business_intelligenceMatch10.2

ibmcognos_business_intelligenceMatch10.2.1

ibmcognos_business_intelligenceMatch10.2.1.1

CPENameOperatorVersion
ibm:cognos_business_intelligenceibm cognos business intelligenceeq8.4.1
ibm:cognos_business_intelligenceibm cognos business intelligenceeq10.1
ibm:cognos_business_intelligenceibm cognos business intelligenceeq10.1.1
ibm:cognos_business_intelligenceibm cognos business intelligenceeq10.2
ibm:cognos_business_intelligenceibm cognos business intelligenceeq10.2.1
ibm:cognos_business_intelligenceibm cognos business intelligenceeq10.2.1.1

CPE	Name	Operator	Version
ibm:cognos_business_intelligence	ibm cognos business intelligence	eq	8.4.1
ibm:cognos_business_intelligence	ibm cognos business intelligence	eq	10.1
ibm:cognos_business_intelligence	ibm cognos business intelligence	eq	10.1.1
ibm:cognos_business_intelligence	ibm cognos business intelligence	eq	10.2
ibm:cognos_business_intelligence	ibm cognos business intelligence	eq	10.2.1
ibm:cognos_business_intelligence	ibm cognos business intelligence	eq	10.2.1.1