CVE-2017-1282

Low

Low Medium High Critical

CVSS Score

Published: May 22, 2017

Last Modified: Apr 20, 2025

Vulnerability Description

IBM Content Navigator & CMIS 2.0 and 3.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 124760.

Known Affected Software

5 configuration(s) from 1 vendor(s)

content_navigator

Version:

2.0.3.8

CPE:

cpe:2.3:a:ibm:content_navigator:2.0.3.8:*:*:*:*:*:*:*

content_navigator

Version:

3.0.0

CPE:

cpe:2.3:a:ibm:content_navigator:3.0.0:*:*:*:continuous_delivery:*:*:*

content_navigator

Version:

2.0.3.6

CPE:

cpe:2.3:a:ibm:content_navigator:2.0.3.6:*:*:*:*:*:*:*

content_navigator

Version:

2.0.3.5

CPE:

cpe:2.3:a:ibm:content_navigator:2.0.3.5:*:*:*:*:*:*:*

content_navigator

Version:

2.0.3.7

CPE:

cpe:2.3:a:ibm:content_navigator:2.0.3.7:*:*:*:*:*:*:*

This vulnerability affects 5 software configuration(s). Ensure you patch all affected systems.

References & Resources

Severity Details

out of 10.0

Low

Weakness Type (CWE)

CWE-79 Top 25 #1

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Exploit Likelihood: High
Typical Severity: Medium
OWASP Top 10: A03:2021-Injection
Abstraction Level: Base