CVE-2013-0499

IBM WebSphere DataPower SOA Appliances 3.8.2-5.0.0 - Cross-Site Scripting via SOAP Message

Title source: llm

Description

Cross-site scripting (XSS) vulnerability in the echo functionality on IBM WebSphere DataPower SOA appliances with firmware 3.8.2, 4.0, 4.0.1, 4.0.2, and 5.0.0 allows remote attackers to inject arbitrary web script or HTML via a SOAP message, as demonstrated by the XML Firewall, Multi Protocol Gateway (MPGW), Web Service Proxy, and Web Token services.

References (4)

Core 4

Core References

Exploit x_refsource_misc

https://www.sec-consult.com/fxdata/seccons/prod/temedia/advisories_txt/20130523-0_IBM_Xi50_Echo-WebService_Xss_in_Xml_v10.txt

Third Party Advisory, VDB Entry vdb-entry x_refsource_xf

https://exchange.xforce.ibmcloud.com/vulnerabilities/82221

Exploit mailing-list x_refsource_bugtraq

http://seclists.org/bugtraq/2013/May/83

Vendor Advisory x_refsource_confirm

http://www-01.ibm.com/support/docview.wss?uid=swg21637717

Scores

EPSS 0.0121

EPSS Percentile 65.2%

Details

CWE

CWE-79

Status published

Products (42)

ibm/websphere_datapower_b2b_appliance_xb62

ibm/websphere_datapower_b2b_appliance_xb62_firmware 3.8.2

ibm/websphere_datapower_b2b_appliance_xb62_firmware 4.0

ibm/websphere_datapower_b2b_appliance_xb62_firmware 4.0.1

ibm/websphere_datapower_b2b_appliance_xb62_firmware 4.0.2

ibm/websphere_datapower_b2b_appliance_xb62_firmware 5.0.0

ibm/websphere_datapower_integration_appliance_xi50

ibm/websphere_datapower_integration_appliance_xi50_firmware 3.8.2

ibm/websphere_datapower_integration_appliance_xi50_firmware 4.0

ibm/websphere_datapower_integration_appliance_xi50_firmware 4.0.1

... and 32 more

Published May 28, 2013

Tracked Since Feb 18, 2026