National Cyber Awareness System

Vulnerability Summary for CVE-2010-4120

Overview

Multiple cross-site scripting (XSS) vulnerabilities in the TAM console in IBM Tivoli Access Manager for e-business 6.1.0 before 6.1.0-TIV-TAM-FP0006 allow remote attackers to inject arbitrary web script or HTML via (1) the parm1 parameter to ivt/ivtserver, or the method parameter to (2) acl, (3) domain, (4) group, (5) gso, (6) gsogroup, (7) os, (8) pop, (9) rule, (10) user, or (11) webseal in ibm/wpm/.

Impact

CVSS Severity (version 2.0):

CVSS Version 2 Metrics:

Solution

Per: http://www-01.ibm.com/support/docview.wss?uid=swg1IZ84918 'The fix for this APAR is expected to be contained in the following maintenance delivery vehicle: fix pack | 6.1.0-TIV-TAM-FP0006' }

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to nvd@nist.gov.

External Source: XF

Name: tivoli-ebusiness-parm1-xss(62750)

Hyperlink:http://xforce.iss.net/xforce/xfdb/62750

External Source: VUPEN

Name: ADV-2010-2774

Type: Advisory

Hyperlink:http://www.vupen.com/english/advisories/2010/2774

External Source: BID

Name: 44382

Hyperlink:http://www.securityfocus.com/bid/44382

External Source: AIXAPAR

Name: IZ84918

Type: Advisory; Exploit

Hyperlink:http://www-01.ibm.com/support/docview.wss?uid=swg1IZ84918

External Source: SECTRACK

Name: 1024633

Hyperlink:http://securitytracker.com/id?1024633

External Source: SECUNIA

Name: 41974

Type: Advisory

Hyperlink:http://secunia.com/advisories/41974

External Source: OSVDB

Name: 68894

Hyperlink:http://osvdb.org/68894

External Source: OSVDB

Name: 68893

Hyperlink:http://osvdb.org/68893

External Source: OSVDB

Name: 68892

Hyperlink:http://osvdb.org/68892

External Source: OSVDB

Name: 68891

Hyperlink:http://osvdb.org/68891

External Source: OSVDB

Name: 68890

Hyperlink:http://osvdb.org/68890

External Source: OSVDB

Name: 68889

Hyperlink:http://osvdb.org/68889

External Source: OSVDB

Name: 68888

Hyperlink:http://osvdb.org/68888

External Source: OSVDB

Name: 68887

Hyperlink:http://osvdb.org/68887

External Source: OSVDB

Name: 68886

Hyperlink:http://osvdb.org/68886

External Source: OSVDB

Name: 68885

Hyperlink:http://osvdb.org/68885

External Source: OSVDB

Name: 68884

Hyperlink:http://osvdb.org/68884