CVE-2014-4748

2014-07-2615:55:03

CWE-79

[email protected]

web.nvd.nist.gov

ibm

sametime

xss

vulnerability

cve-2014-4748

nvd

ibm sametime 8.x

classic meeting server

4.3 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

5.6 Medium

AI Score

Confidence

High

0.003 Low

EPSS

Percentile

65.2%

JSON

Cross-site scripting (XSS) vulnerability in the Classic Meeting Server in IBM Sametime 8.x through 8.5.2.1 allows remote attackers to inject arbitrary web script or HTML via a crafted URL.

Affected configurations

NVD

Node

ibmsametimeMatch8.0.0.0

ibmsametimeMatch8.0.1.0

ibmsametimeMatch8.0.1.1

ibmsametimeMatch8.0.2.0

ibmsametimeMatch8.0.2.1

ibmsametimeMatch8.5.0.0

ibmsametimeMatch8.5.1.0

ibmsametimeMatch8.5.1.1

ibmsametimeMatch8.5.2.0

ibmsametimeMatch8.5.2.1

CPENameOperatorVersion
ibm:sametimeibm sametimeeq8.0.0.0
ibm:sametimeibm sametimeeq8.0.1.0
ibm:sametimeibm sametimeeq8.0.1.1
ibm:sametimeibm sametimeeq8.0.2.0
ibm:sametimeibm sametimeeq8.0.2.1
ibm:sametimeibm sametimeeq8.5.0.0
ibm:sametimeibm sametimeeq8.5.1.0
ibm:sametimeibm sametimeeq8.5.1.1
ibm:sametimeibm sametimeeq8.5.2.0
ibm:sametimeibm sametimeeq8.5.2.1

CPE	Name	Operator	Version
ibm:sametime	ibm sametime	eq	8.0.0.0
ibm:sametime	ibm sametime	eq	8.0.1.0
ibm:sametime	ibm sametime	eq	8.0.1.1
ibm:sametime	ibm sametime	eq	8.0.2.0
ibm:sametime	ibm sametime	eq	8.0.2.1
ibm:sametime	ibm sametime	eq	8.5.0.0
ibm:sametime	ibm sametime	eq	8.5.1.0
ibm:sametime	ibm sametime	eq	8.5.1.1
ibm:sametime	ibm sametime	eq	8.5.2.0
ibm:sametime	ibm sametime	eq	8.5.2.1