VYPR
← All advisories
Unrated severityNVD Advisory· Published Dec 19, 2014· Updated Jun 17, 2026

CVE-2014-8902

CVE-2014-8902

Description

Cross-site scripting (XSS) vulnerability in the Blog Portlet in IBM WebSphere Portal 6.1.0 through 6.1.0.6 CF27, 6.1.5 through 6.1.5.3 CF27, 7.0.0 through 7.0.0.2 CF29, 8.0.0 through 8.0.0.1 CF14, and 8.5.0 before CF04 allows remote attackers to inject arbitrary web script or HTML via a crafted URL.

Affected products

18
  • IBM/Websphere Portal18 versions
    cpe:2.3:a:ibm:websphere_portal:6.1.0.0:*:*:*:*:*:*:*+ 17 more
    • cpe:2.3:a:ibm:websphere_portal:6.1.0.0:*:*:*:*:*:*:*
    • cpe:2.3:a:ibm:websphere_portal:6.1.0.1:*:*:*:*:*:*:*
    • cpe:2.3:a:ibm:websphere_portal:6.1.0.2:*:*:*:*:*:*:*
    • cpe:2.3:a:ibm:websphere_portal:6.1.0.3:*:*:*:*:*:*:*
    • cpe:2.3:a:ibm:websphere_portal:6.1.0.4:*:*:*:*:*:*:*
    • cpe:2.3:a:ibm:websphere_portal:6.1.0.5:*:*:*:*:*:*:*
    • cpe:2.3:a:ibm:websphere_portal:6.1.0.6:*:*:*:*:*:*:*
    • cpe:2.3:a:ibm:websphere_portal:6.1.5.0:*:*:*:*:*:*:*
    • cpe:2.3:a:ibm:websphere_portal:6.1.5.1:*:*:*:*:*:*:*
    • cpe:2.3:a:ibm:websphere_portal:6.1.5.2:*:*:*:*:*:*:*
    • cpe:2.3:a:ibm:websphere_portal:6.1.5.3:*:*:*:*:*:*:*
    • cpe:2.3:a:ibm:websphere_portal:7.0.0.0:*:*:*:*:*:*:*
    • cpe:2.3:a:ibm:websphere_portal:7.0.0.1:*:*:*:*:*:*:*
    • cpe:2.3:a:ibm:websphere_portal:7.0.0.2:*:*:*:*:*:*:*
    • cpe:2.3:a:ibm:websphere_portal:8.0.0.0:*:*:*:*:*:*:*
    • cpe:2.3:a:ibm:websphere_portal:8.0.0.1:*:*:*:*:*:*:*
    • cpe:2.3:a:ibm:websphere_portal:8.5.0.0:*:*:*:*:*:*:*
    • (no CPE)range: 6.1.0-6.1.0.6 CF27, 6.1.5-6.1.5.3 CF27, 7.0.0-7.0.0.2 CF29, 8.0.0-8.0.0.1 CF14, 8.5.0 before CF04

Patches

Vulnerability mechanics

References

3

News mentions

0

No linked articles in our index yet.