Unscored severity · published May 28, 2013
CVE-2013-0499
Cross-site scripting (XSS) vulnerability in the echo functionality on IBM WebSphere DataPower SOA appliances with firmware 3.8.2, 4.0, 4.0.1, 4.0.2, and 5.0.0 allows remote…
–
CVSS
1.2%
EPSS
No
On KEV
Description
Cross-site scripting (XSS) vulnerability in the echo functionality on IBM WebSphere DataPower SOA appliances with firmware 3.8.2, 4.0, 4.0.1, 4.0.2, and 5.0.0 allows remote attackers to inject arbitrary web script or HTML via a SOAP message, as demonstrated by the XML Firewall, Multi Protocol Gateway (MPGW), Web Service Proxy, and Web Token services.
Exploitation
Is it being used?
Exploit prediction (EPSS)1.2% · higher than 68% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
WD
Websphere Datapower B2b Appliance Xb62 · Ibm
All versions, or not specified · source: NVD
WD
Websphere Datapower B2b Appliance Xb62 Firmware · Ibm
3.8.2; 4.0; 4.0.1; 4.0.2; 5.0.0 · source: NVD
WD
Websphere Datapower Integration Appliance Xi50 · Ibm
All versions, or not specified · source: NVD
WD
Websphere Datapower Integration Appliance Xi50 Firmware · Ibm
3.8.2; 4.0; 4.0.1; 4.0.2; 5.0.0 · source: NVD
WD
Websphere Datapower Integration Appliance Xi52 · Ibm
All versions, or not specified · source: NVD
WD
Websphere Datapower Integration Appliance Xi52 Firmware · Ibm
3.8.2; 4.0; 4.0.1; 4.0.2; 5.0.0 · source: NVD
WD
Websphere Datapower Integration Appliance Xi52 Virtual Edition · Ibm
All versions, or not specified · source: NVD
WD
Websphere Datapower Integration Appliance Xi52 Virtual Edition Firmware · Ibm
3.8.2; 4.0; 4.0.1; 4.0.2; 5.0.0 · source: NVD
WD
Websphere Datapower Service Gateway Xg45 · Ibm
All versions, or not specified · source: NVD
WD
Websphere Datapower Service Gateway Xg45 Firmware · Ibm
3.8.2; 4.0; 4.0.1; 4.0.2; 5.0.0 · source: NVD
WD
Websphere Datapower Service Gateway Xg45 Virtual Edition · Ibm
All versions, or not specified · source: NVD
WD
Websphere Datapower Service Gateway Xg45 Virtual Edition Firmware · Ibm
3.8.2; 4.0; 4.0.1; 4.0.2; 5.0.0 · source: NVD
Affected product
WD
Websphere Datapower B2b Appliance Xb62
Ibm
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2013-0499
CVE.org
https://www.cve.org/CVERecord?id=CVE-2013-0499
Exploit
http://seclists.org/bugtraq/2013/May/83
Vendor Advisory
http://www-01.ibm.com/support/docview.wss?uid=swg21637717
exchange.xforce.ibmcloud.com
https://exchange.xforce.ibmcloud.com/vulnerabilities/82221
Exploit
https://www.sec-consult.com/fxdata/seccons/prod/temedia/advisories_txt/20130523-0_IBM_Xi50_Echo-WebService_Xss_in_Xml_v10.txt