CVE-2012-5943 - OpenCVE

Cross-site scripting (XSS) vulnerability in IBM iNotes 8.5.x before 8.5.3 FP4 allows user-assisted remote attackers to inject arbitrary web script or HTML via vectors involving mail, aka SPR JDOE8ZZS9.

No CVSS v3.1

No CVSS v3.0

Access Vector Network

Access Complexity Medium

Authentication None

Confidentiality Impact None

Integrity Impact Partial

Availability Impact None

AV:N/AC:M/Au:N/C:N/I:P/A:N

Vendors & Products
CPE Configurations

Vendors	Products
Ibm	Lotus Inotes

Configuration 1 [-]

OR	cpe:2.3:a:ibm:lotus_inotes:8.5.0.0:::::::*
	cpe:2.3:a:ibm:lotus_inotes:8.5.0.1:::::::*
	cpe:2.3:a:ibm:lotus_inotes:8.5.1.0:::::::*
	cpe:2.3:a:ibm:lotus_inotes:8.5.1.1:::::::*
	cpe:2.3:a:ibm:lotus_inotes:8.5.1.2:::::::*
	cpe:2.3:a:ibm:lotus_inotes:8.5.1.3:::::::*
	cpe:2.3:a:ibm:lotus_inotes:8.5.1.4:::::::*
	cpe:2.3:a:ibm:lotus_inotes:8.5.1.5:::::::*
	cpe:2.3:a:ibm:lotus_inotes:8.5.2.0:::::::*
	cpe:2.3:a:ibm:lotus_inotes:8.5.2.1:::::::*
	cpe:2.3:a:ibm:lotus_inotes:8.5.2.2:::::::*
	cpe:2.3:a:ibm:lotus_inotes:8.5.2.3:::::::*
	cpe:2.3:a:ibm:lotus_inotes:8.5.3.0:::::::*
	cpe:2.3:a:ibm:lotus_inotes:8.5.3.1:::::::*
	cpe:2.3:a:ibm:lotus_inotes:8.5.3.2:::::::*

References

Link	Resource
http://www-01.ibm.com/support/docview.wss?uid=swg21628658	Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/80538

History

No history.

MITRE Information

Status: PUBLISHED

Assigner: ibm

Published: 2013-03-26T21:00:00

Updated: 2017-08-28T12:57:01

Reserved: 2012-11-21T00:00:00

Link: CVE-2012-5943

JSON object: View

NVD Information

Status : Modified

Published: 2013-03-26T21:55:01.003

Modified: 2017-08-29T01:32:52.463

Link: CVE-2012-5943

JSON object: View

Redhat Information

No data.

CWE

CWE-79

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:ibm:lotus_inotes:8.5.0.0:*:*:*:*:*:*:*", "matchCriteriaId": "FF04F0F8-E2AC-4080-91CE-E871CF32FBB1", "vulnerable": true}, {"criteria": "cpe:2.3:a:ibm:lotus_inotes:8.5.0.1:*:*:*:*:*:*:*", "matchCriteriaId": "8865EB47-3C1B-485B-94CA-852F1C40FDE7", "vulnerable": true}, {"criteria": "cpe:2.3:a:ibm:lotus_inotes:8.5.1.0:*:*:*:*:*:*:*", "matchCriteriaId": "7FA02A70-D433-4AEB-B7CD-77744E52D280", "vulnerable": true}, {"criteria": "cpe:2.3:a:ibm:lotus_inotes:8.5.1.1:*:*:*:*:*:*:*", "matchCriteriaId": "84F5294B-DAEF-4450-81C1-AEB951364336", "vulnerable": true}, {"criteria": "cpe:2.3:a:ibm:lotus_inotes:8.5.1.2:*:*:*:*:*:*:*", "matchCriteriaId": "0EF658AD-31D5-4A88-920E-98B722D48355", "vulnerable": true}, {"criteria": "cpe:2.3:a:ibm:lotus_inotes:8.5.1.3:*:*:*:*:*:*:*", "matchCriteriaId": "C029E446-2BBA-491D-9AA0-D83A3879CCBC", "vulnerable": true}, {"criteria": "cpe:2.3:a:ibm:lotus_inotes:8.5.1.4:*:*:*:*:*:*:*", "matchCriteriaId": "618F1C0E-8E43-4D63-A497-9FFEE4E3A90D", "vulnerable": true}, {"criteria": "cpe:2.3:a:ibm:lotus_inotes:8.5.1.5:*:*:*:*:*:*:*", "matchCriteriaId": "53A4CC23-6053-40FC-BFC8-08FAA9F0AE53", "vulnerable": true}, {"criteria": "cpe:2.3:a:ibm:lotus_inotes:8.5.2.0:*:*:*:*:*:*:*", "matchCriteriaId": "CA621B45-7747-491D-A983-DD125BEE2753", "vulnerable": true}, {"criteria": "cpe:2.3:a:ibm:lotus_inotes:8.5.2.1:*:*:*:*:*:*:*", "matchCriteriaId": "DA57E455-B3CB-4F53-854B-21D8DFB95ED1", "vulnerable": true}, {"criteria": "cpe:2.3:a:ibm:lotus_inotes:8.5.2.2:*:*:*:*:*:*:*", "matchCriteriaId": "96E0153C-BDC4-4D01-A292-AD97A5C168EA", "vulnerable": true}, {"criteria": "cpe:2.3:a:ibm:lotus_inotes:8.5.2.3:*:*:*:*:*:*:*", "matchCriteriaId": "A4ED4C08-82E5-4165-A585-E23E23015609", "vulnerable": true}, {"criteria": "cpe:2.3:a:ibm:lotus_inotes:8.5.3.0:*:*:*:*:*:*:*", "matchCriteriaId": "76D0D493-1BFD-4054-BDB0-F338BFAFDC5F", "vulnerable": true}, {"criteria": "cpe:2.3:a:ibm:lotus_inotes:8.5.3.1:*:*:*:*:*:*:*", "matchCriteriaId": "F088F719-F4BE-4B49-B022-96D43664155B", "vulnerable": true}, {"criteria": "cpe:2.3:a:ibm:lotus_inotes:8.5.3.2:*:*:*:*:*:*:*", "matchCriteriaId": "B7F797B7-C3EA-4A12-8D69-217FBD4B9EB1", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "Cross-site scripting (XSS) vulnerability in IBM iNotes 8.5.x before 8.5.3 FP4 allows user-assisted remote attackers to inject arbitrary web script or HTML via vectors involving mail, aka SPR JDOE8ZZS9."}, {"lang": "es", "value": "Vulnerabilidad de ejecuci\u00f3n de secuencias de comandos en sitios cruzados (XSS) en IBM iNotes v8.5.x anterior a v8.5.3 FP4 que permite usuarios asistidos remotos inyectar secuencias de comandos web o HTML a trav\u00e9s de vectores implicando el correo, tambi\u00e9n conocido SPR JDOE8ZZS9."}], "id": "CVE-2012-5943", "lastModified": "2017-08-29T01:32:52.463", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 4.3, "confidentialityImpact": "NONE", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N", "version": "2.0"}, "exploitabilityScore": 8.6, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": true}]}, "published": "2013-03-26T21:55:01.003", "references": [{"source": "psirt@us.ibm.com", "tags": ["Vendor Advisory"], "url": "http://www-01.ibm.com/support/docview.wss?uid=swg21628658"}, {"source": "psirt@us.ibm.com", "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/80538"}], "sourceIdentifier": "psirt@us.ibm.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "nvd@nist.gov", "type": "Primary"}]}