CVE-2015-1888

Low

Low Medium High Critical

CVSS Score

Published: Oct 03, 2015

Last Modified: Apr 12, 2025

Vulnerability Description

Cross-site scripting (XSS) vulnerability in IBM Content Navigator 2.0.2 before 2.0.2-ICN-FP007 and 2.0.3 before 2.0.3-ICN-FP003, as used in Content Manager, FileNet Content Manager, Content Foundation, Content Manager OnDemand, and other products, allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL.

Known Affected Software

2 configuration(s) from 1 vendor(s)

content_navigator

Version:

2.0.2

CPE:

cpe:2.3:a:ibm:content_navigator:2.0.2:*:*:*:*:*:*:*

content_navigator

Version:

2.0.3

CPE:

cpe:2.3:a:ibm:content_navigator:2.0.3:*:*:*:*:*:*:*

This vulnerability affects 2 software configuration(s). Ensure you patch all affected systems.

References & Resources

Severity Details

out of 10.0

Low

Weakness Type (CWE)

CWE-79 Top 25 #1

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Exploit Likelihood: High
Typical Severity: Medium
OWASP Top 10: A03:2021-Injection
Abstraction Level: Base