CVE-2017-1189

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

IBM WebSphere Portal and Web Content Manager 6.1, 7.0, and 8.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 123558.

Metrics

CVSS 3.0 6.1/10CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://www.ibm.com/support/docview.wss?uid=swg22008028Vendor Advisory
http://www.securityfocus.com/bid/100699Third Party Advisory, VDB Entry
http://www.securitytracker.com/id/1039268Third Party Advisory, VDB Entry
https://exchange.xforce.ibmcloud.com/vulnerabilities/123558VDB Entry, Vendor Advisory
http://www.ibm.com/support/docview.wss?uid=swg22008028Vendor Advisory
http://www.securityfocus.com/bid/100699Third Party Advisory, VDB Entry
http://www.securitytracker.com/id/1039268Third Party Advisory, VDB Entry
https://exchange.xforce.ibmcloud.com/vulnerabilities/123558VDB Entry, Vendor Advisory

Timeline

Published: Sep 7, 2017
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2017

CVE-2017-118907.5Microsoft Windows 7 SP1, Windows Server 2008 and R2 SP1, Windows 8.1 and Windows RT 8.1, Windows Server 2012 and R2, Windows 10 Gold, 1511, CVE-2017-118937.5ChakraCore and Microsoft Edge in Windows 10 1511, 1607, 1703, 1709, and Windows Server 2016 allows an attacker to execute arbitrary code in CVE-2017-118947.5ChakraCore, and Internet Explorer in Microsoft Windows 7 SP1, Windows Server 2008 and R2 SP1, Windows 8.1 and Windows RT 8.1, Windows Server CVE-2017-118957.5ChakraCore, and Internet Explorer in Microsoft Windows 7 SP1, Windows Server 2008 R2 SP1, Windows 8.1 and Windows RT 8.1, Windows Server 201 CVE-2017-118999.8Device Guard in Windows 10 1511, 1607, 1703 and 1709, Windows Server 2016 and Windows Server, version 1709 allows a security feature bypass CVE-2017-11906.4IBM Emptoris Strategic Supply Management Platform 10.x and 10.1 could allow a local user with special access roles to execute arbitrary code CVE-2017-119017.5Internet Explorer in Microsoft Windows 7 SP1, Windows Server 2008 R2 SP1, Windows 8.1 and Windows RT 8.1, Windows Server 2012 and R2, Window CVE-2017-119037.5Internet Explorer in Microsoft Windows 7 SP1, Windows Server 2008 and R2 SP1, Windows 8.1 and Windows RT 8.1, Windows Server 2012 and R2, Wi CVE-2017-119057.5ChakraCore and Microsoft Edge in Windows 10 1511, 1607, 1703, 1709, and Windows Server 2016 allows an attacker to execute arbitrary code in CVE-2017-119065.3Internet Explorer in Microsoft Windows 7 SP1, Windows Server 2008 and R2 SP1, Windows 8.1 and Windows RT 8.1, Windows Server 2012 and R2, an CVE-2017-119077.5Internet Explorer in Microsoft Windows 7 SP1, Windows Server 2008 and R2 SP1, Windows 8.1 and Windows RT 8.1, Windows Server 2012 and R2, Wi CVE-2017-119087.5ChakraCore and Windows 10 1709 allows an attacker to execute arbitrary code in the context of the current user, due to how the scripting eng