CVE-2009-2316

IBM Tivoli Identity Manager <5.0 - XSS

Title source: llm

Description

Multiple cross-site scripting (XSS) vulnerabilities in IBM Tivoli Identity Manager (ITIM) 5.0 allow remote attackers to inject arbitrary web script or HTML by entering an unspecified URL in (1) the self-service UI interface or (2) the console interface. NOTE: it was later reported that 4.6.0 is also affected by the first vector.

References (13)

[Third Party Advisory, VDB Entry] http://osvdb.org/55550

[Third Party Advisory, VDB Entry] http://osvdb.org/55551

[Vendor Advisory] http://secunia.com/advisories/35696

[Vendor Advisory] http://www-01.ibm.com/support/docview.wss?uid=swg1IZ54310

[Various Sources] http://www-01.ibm.com/support/docview.wss?uid=swg1IZ54311

[Various Sources] http://www-01.ibm.com/support/docview.wss?uid=swg1IZ55518

[Patch, Vendor Advisory] http://www-01.ibm.com/support/docview.wss?uid=swg24023640

[Various Sources] http://www-01.ibm.com/support/docview.wss?uid=swg24023929

[Third Party Advisory, VDB Entry] http://www.securitytracker.com/id?1022508

[Third Party Advisory, VDB Entry] http://www.securityfocus.com/bid/35566

[Third Party Advisory] http://secunia.com/advisories/36119

[Third Party Advisory] http://www.vupen.com/english/advisories/2009/1774

[Third Party Advisory] http://www.vupen.com/english/advisories/2009/2106

Scores

EPSS 0.0060

EPSS Percentile 69.1%

Classification

CWE

CWE-79

Status published

Affected Products (2)

ibm/tivoli_identity_manager

n/a/n/a

Timeline

Published Jul 05, 2009

Tracked Since Feb 18, 2026