Vulnerability Details : CVE-2013-6732
Cross-site scripting (XSS) vulnerability in the server in IBM Cognos Business Intelligence (BI) 8.4.1, 10.1 before IF6, 10.1.1 before IF5, 10.2 before IF7, 10.2.1 before IF4, and 10.2.1.1 before IF4 allows remote attackers to inject arbitrary web script or HTML via an unspecified parameter.
Vulnerability category: Cross site scripting (XSS)
Exploit prediction scoring system (EPSS) score for CVE-2013-6732
Probability of exploitation activity in the next 30 days: 0.13%
Percentile, the proportion of vulnerabilities that are scored at or less: ~ 46 % EPSS Score History EPSS FAQ
CVSS scores for CVE-2013-6732
Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source |
---|---|---|---|---|---|
4.3
|
MEDIUM | AV:N/AC:M/Au:N/C:N/I:P/A:N |
8.6
|
2.9
|
NIST |
CWE ids for CVE-2013-6732
-
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.Assigned by: nvd@nist.gov (Primary)
References for CVE-2013-6732
-
http://www-01.ibm.com/support/docview.wss?uid=swg21662856
IBM Security Bulletin: Multiple security exposures in IBM Cognos BI Server (CVE-2013-6954, CVE-2013-6732, CVE-2013-5802, CVE-2013-5825, CVE-2014-0854, CVE-2014-0861)Vendor Advisory
-
https://exchange.xforce.ibmcloud.com/vulnerabilities/89394
IBM Cognos Business Intelligence cross-site scripting CVE-2013-6732 Vulnerability Report
Products affected by CVE-2013-6732
- cpe:2.3:a:ibm:cognos_business_intelligence:8.4.1:*:*:*:*:*:*:*
- cpe:2.3:a:ibm:cognos_business_intelligence:10.1:*:*:*:*:*:*:*
- cpe:2.3:a:ibm:cognos_business_intelligence:10.1.1:*:*:*:*:*:*:*
- cpe:2.3:a:ibm:cognos_business_intelligence:10.2:*:*:*:*:*:*:*
- cpe:2.3:a:ibm:cognos_business_intelligence:10.2.1:*:*:*:*:*:*:*
- cpe:2.3:a:ibm:cognos_business_intelligence:10.2.1.1:*:*:*:*:*:*:*