CVE:CVE-2013-0499
CNNVD:CNNVD-201305-593
IBM WebSphere DataPower SOA Appliances是美国IBM公司的一套网络设备。该设备主要用于简化、保护和加速SOA中的XML和Web服务部署。
IBM WebSphere DataPower SOA应用程序固件的3.8.2版本，4.0版本，4.0.1版本，4.0.2及5.0.0版本的echo功能中存在跨站脚本漏洞。远程攻击者可通过SOAP消息（如XML防火墙，多协议网关MPGW，Web服务代理和Web令牌服务）利用该漏洞注入任意Web脚本或HTML。
solution:Upgrade ibm websphere_datapower_xc10_appliance_firmware to a higher version than 3.8.2,4.0,4.0.1,4.0.2,5.0.0,and avoid the version 3.8.2,4.0,4.0.1,4.0.2,5.0.0; Upgrade ibm websphere_datapower_xc10_appliance to a higher version than -; Upgrade ibm websphere_datapower_service_gateway_xg45_virtual_edition_firmware to a higher version than 3.8.2,4.0,4.0.1,4.0.2,5.0.0,and avoid the version 3.8.2,4.0,4.0.1,4.0.2,5.0.0; Upgrade ibm websphere_datapower_service_gateway_xg45_virtual_edition to a higher version than -; Upgrade ibm websphere_datapower_service_gateway_xg45_firmware to a higher version than 3.8.2,4.0,4.0.1,4.0.2,5.0.0,and avoid the version 3.8.2,4.0,4.0.1,4.0.2,5.0.0; Upgrade ibm websphere_datapower_service_gateway_xg45 to a higher version than -; Upgrade ibm websphere_datapower_integration_appliance_xi52_virtual_edition_firmware to a higher version than 3.8.2,4.0,4.0.1,4.0.2,5.0.0,and avoid the version 3.8.2,4.0,4.0.1,4.0.2,5.0.0; Upgrade ibm websphere_datapower_integration_appliance_xi52_virtual_edition to a higher version than -; Upgrade ibm websphere_datapower_integration_appliance_xi52_firmware to a higher version than 3.8.2,4.0,4.0.1,4.0.2,5.0.0,and avoid the version 3.8.2,4.0,4.0.1,4.0.2,5.0.0; Upgrade ibm websphere_datapower_integration_appliance_xi52 to a higher version than -; Upgrade ibm websphere_datapower_integration_appliance_xi50_firmware to a higher version than 3.8.2,4.0,4.0.1,4.0.2,5.0.0,and avoid the version 3.8.2,4.0,4.0.1,4.0.2,5.0.0; Upgrade ibm websphere_datapower_integration_appliance_xi50 to a higher version than -; Upgrade ibm websphere_datapower_b2b_appliance_xb62_firmware to a higher version than 3.8.2,4.0,4.0.1,4.0.2,5.0.0,and avoid the version 3.8.2,4.0,4.0.1,4.0.2,5.0.0; Upgrade ibm websphere_datapower_b2b_appliance_xb62 to a higher version than -