CVE-2014-0870

Vulnerability

Multiple cross-site scripting (XSS) vulnerabilities exist in the RICOS component of IBM Algo Credit Limits (ACLM) versions 4.5.0 through 4.7.0 before 4.7.0.03 FP5. The flaws are located in several JSP pages where user-supplied input is not properly sanitized before being rendered. The affected parameters include the Message parameter in rcore6/main/showerror.jsp, the ButtonsetClass parameter in rcore6/main/buttonset.jsp, the MBName parameter in rcore6/frameset.jsp, the Init parameter in algopds/rcore6/main/browse.jsp, and the Name, StoreName, or STYLESHEET parameters in algopds/rcore6/main/ibrowseheader.jsp [1][2].

Exploitation

An unauthenticated remote attacker can exploit these vulnerabilities by crafting a malicious URL or form submission containing specially crafted JavaScript or HTML. No special user privileges are required beyond the ability to send HTTP requests to the affected web application. The attacker does not need to be authenticated, as the vulnerable endpoints are accessible without a valid session [1].

Impact

Successful exploitation allows the attacker to inject and execute arbitrary web script or HTML in the context of the victim's browser. This can lead to session hijacking, credential theft, defacement, or redirection to malicious sites, compromising the confidentiality and integrity of the web application's data [1][2].

Mitigation

IBM has released fix pack 4.7.0.03 FP5 to address these issues. Users should upgrade to this version or later as soon as possible. If immediate patching is not feasible, administrators should restrict network access to the RICOS web application to trusted users and networks as a temporary workaround [2]. No KEV listing was found for this CVE.