CVE-2013-4003

IBM TRIRIGA Application Platform < 3.3.1.1 - Authenticated Cross-Site Scripting via Multiple URL Parameters

Title source: llm

Description

Multiple cross-site scripting (XSS) vulnerabilities in IBM TRIRIGA Application Platform 2.x and 3.x before 3.3.1.1, and 8, allow remote authenticated users to inject arbitrary web script or HTML via (1) unspecified input to WebProcess.srv, (2) unspecified input to html/en/default/actionHandler/queryHandler.jsp, or (3) unspecified input in a portalSectionId action to html/en/default/reportTemplate/hGridTopQuery.jsp.

References (3)

Core 3

Core References

Vendor Advisory x_refsource_confirm

http://www-01.ibm.com/support/docview.wss?uid=swg21646694

Third Party Advisory, VDB Entry vdb-entry x_refsource_xf

https://exchange.xforce.ibmcloud.com/vulnerabilities/85266

Various Sources x_refsource_confirm

https://www.ibm.com/connections/blogs/PSIRT/entry/security_bulletin_ibm_tririga_application_platform_has_potential_cross_site_scripting_vulnerabilities_in_various_url_s

Scores

EPSS 0.0094

EPSS Percentile 57.1%

Details

CWE

CWE-79

Status published

Products (10)

ibm/tririga_application_platform 2.1

ibm/tririga_application_platform 2.5

ibm/tririga_application_platform 2.6

ibm/tririga_application_platform 2.7

ibm/tririga_application_platform 3.0

ibm/tririga_application_platform 3.1

ibm/tririga_application_platform 3.2

ibm/tririga_application_platform 3.2.1

ibm/tririga_application_platform 3.3.0.0

ibm/tririga_application_platform < 3.3.0.1

Published Aug 29, 2013

Tracked Since Feb 18, 2026