Lucene search

IbmCVE-2020-4987

HistoryMay 04, 2021 - 4:15 p.m.

CVE-2020-4987

2021-05-0416:15:07

CWE-79

ibm

web.nvd.nist.gov

ibm

flashsystem 900

user management

gui

vulnerability

stored

cross-site scripting

nvd

cve-2020-4987

CVSS2

3.5

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

SINGLE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:S/C:N/I:P/A:N

CVSS3

5.4

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

AI Score

5.2

Confidence

High

EPSS

0.001

Percentile

19.6%

JSON

The IBM FlashSystem 900 user management GUI is vulnerable to stored cross-site scripting in code versions 1.5.2.8 and prior and 1.6.1.2 and prior. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.

Affected configurations

Nvd

Vulners

Node

ibmflashsystem_900Match-

AND

ibmflashsystem_900_firmwareRange<1.5.2.9

ibmflashsystem_900_firmwareRange1.6.0.0–1.6.1.3

VendorProductVersionCPE
ibmflashsystem_900-cpe:2.3:h:ibm:flashsystem_900:-:*:*:*:*:*:*:*
ibmflashsystem_900_firmware*cpe:2.3:o:ibm:flashsystem_900_firmware:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
ibm	flashsystem_900	-	cpe:2.3:h:ibm:flashsystem_900:-:::::::*
ibm	flashsystem_900_firmware	*	cpe:2.3:o:ibm:flashsystem_900_firmware::::::::

CNA Affected

[
  {
    "product": "FlashSystem 900",
    "vendor": "IBM",
    "versions": [
      {
        "status": "affected",
        "version": "1.6.1.2"
      },
      {
        "status": "affected",
        "version": "1.5.2.8"
      }
    ]
  }
]

References

exchange.xforce.ibmcloud.com/vulnerabilities/192702

www.ibm.com/support/pages/node/6449280

Social References

CVSS2

3.5

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

SINGLE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:S/C:N/I:P/A:N

CVSS3

5.4

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

AI Score

5.2

Confidence

High

EPSS

0.001

Percentile

19.6%

JSON

Related for CVE-2020-4987