Unscored severity · published Feb 14, 2014
CVE-2013-3983
The Meeting Server in IBM Sametime 8.5.2 through 8.5.2.1 and 9.x through 9.0.0.1 does not validate URLs in Cookie headers before using them in redirects, which has unspecified…
–
CVSS
1.1%
EPSS
No
On KEV
Description
The Meeting Server in IBM Sametime 8.5.2 through 8.5.2.1 and 9.x through 9.0.0.1 does not validate URLs in Cookie headers before using them in redirects, which has unspecified impact and remote attack vectors.
Exploitation
Is it being used?
Exploit prediction (EPSS)1.1% · higher than 65% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SA
Sametime · Ibm
8.5.2.0; 8.5.2.1; 9.0.0.0; 9.0.0.1 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2013-3983
CVE.org
https://www.cve.org/CVERecord?id=CVE-2013-3983
Vendor Advisory
http://www-01.ibm.com/support/docview.wss?uid=swg21662928
exchange.xforce.ibmcloud.com
https://exchange.xforce.ibmcloud.com/vulnerabilities/84966
More from Sametime
7.8
CVE-2016-2972
IBM Sametime Meeting Server 8.5.2 and 9.0 could store credentials of the Sametime Meetings user in the local cache of their browser which could be accessed by a local user
6.5
CVE-2016-2965
IBM Sametime Meeting Server 8.5.2 and 9.0 is vulnerable to cross-site request forgery, caused by improper validation of user-supplied input
6.5
CVE-2016-0356
IBM Sametime Enterprise Meeting Server 8.5.2 and 9.0 could allow an authenticated user that has been invited to a Sametime meeting room, to cause the screen sharing to cease…
6.5
CVE-2016-0355
IBM Sametime Enterprise Meeting Server 8.5.2 and 9.0 could allow an authenticated user that has been invited to a Sametime meeting room, to cause the screen sharing to cease…
6.3
CVE-2016-2980
The Sametime WebPlayer 8.5.2 and 9.0 is vulnerable to a script injection where a malicious site can inject their own script by exploiting a vulnerability in the way that the…