CVE-2010-2325

Vulnerability

IBM WebSphere Application Server (WAS) 7.0 for z/OS before version 7.0.0.11 contains a cross-site scripting (XSS) vulnerability in the administrative console. The issue is related to "URL injection" via unspecified vectors, allowing injection of arbitrary web script or HTML. Affected versions are WAS 7.0.0.0 through 7.0.0.10 on z/OS. [1]

Exploitation

An attacker can exploit this vulnerability by crafting a malicious URL that, when accessed by an authenticated administrator, injects script into the administrative console. No authentication is required for the attacker to deliver the payload, but the victim must be logged into the console. The attack vector is network-based, requiring the attacker to trick an administrator into clicking a crafted link or visiting a malicious page. [1]

Impact

Successful exploitation allows the attacker to execute arbitrary web script or HTML in the context of the administrative console session. This could lead to session hijacking, defacement, or theft of sensitive information accessible to the administrator. The impact is limited to the browser session of the victim administrator. [1]

Mitigation

IBM released fix pack 7.0.0.11 for WebSphere Application Server V7.0 for z/OS, which includes the fix for this vulnerability. The fix is available via APAR PM15830. Users should upgrade to version 7.0.0.11 or later. No workarounds are documented in the available reference. [1]