CVE-2014-6196

IBM Web Experience Factory 6.1.5-8.5.0.1 - Cross-Site Scripting via Dojo Builder Error

Title source: llm
STIX 2.1

Description

Cross-site scripting (XSS) vulnerability in IBM Web Experience Factory (WEF) 6.1.5 through 8.5.0.1, as used in WebSphere Dashboard Framework (WDF) and Lotus Widget Factory (LWF), allows remote attackers to inject arbitrary web script or HTML by leveraging a Dojo builder error in an unspecified WebSphere Portal configuration, leading to improper construction of a response page by an application.

References (8)

Core 8
Core References
Various Sources vendor-advisory x_refsource_aixapar
http://www-01.ibm.com/support/docview.wss?uid=swg1LO82674
Vendor Advisory x_refsource_confirm
http://www-01.ibm.com/support/docview.wss?uid=swg21690018
Various Sources vendor-advisory x_refsource_aixapar
http://www-01.ibm.com/support/docview.wss?uid=swg1LO82675
Third Party Advisory, VDB Entry vdb-entry x_refsource_xf
https://exchange.xforce.ibmcloud.com/vulnerabilities/98608
Various Sources vendor-advisory x_refsource_aixapar
http://www-01.ibm.com/support/docview.wss?uid=swg1LO82672
Various Sources vendor-advisory x_refsource_aixapar
http://www-01.ibm.com/support/docview.wss?uid=swg1LO82676
Third Party Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/59546
Various Sources vendor-advisory x_refsource_aixapar
http://www-01.ibm.com/support/docview.wss?uid=swg1LO82673

Scores

EPSS 0.0136
EPSS Percentile 68.8%

Details

CWE
CWE-79
Status published
Products (13)
ibm/web_experience_factory 6.1.5
ibm/web_experience_factory 7.0.1
ibm/web_experience_factory 7.0.1.1
ibm/web_experience_factory 7.0.1.2
ibm/web_experience_factory 7.0.1.3
ibm/web_experience_factory 7.0.1.4
ibm/web_experience_factory 8.0
ibm/web_experience_factory 8.0.0
ibm/web_experience_factory 8.0.0.1
ibm/web_experience_factory 8.0.0.2
... and 3 more
Published Nov 26, 2014
Tracked Since Feb 18, 2026