CVE:CVE-2010-2654
CNNVD:CNNVD-201007-063
具有高级管理模块(AMM)固件BPET48L，可能还有4.7之前版本以及5.0版本的IBM BladeCenter存在多个跨站脚本攻击漏洞(XSS)。远程攻击者可以借助(1)INDEX或者(2)private/cindefn.php中IPADDR参数，(3)private/power_management_policy_options.php中domain参数，(4)private/pm_temp.php或者(5)private/power_module.php中的slot参数，(6)private/blade_leds.php中WEBINDEX参数，或者(7)private/ipmi_bladestatus.php中SLOT参数注入任意的web脚本或者HTML。
solution:Upgrade ibm advanced_management_module to a higher version than *:l,*:g,1.00,1.01,1.20,1.20:f,1.25,1.25:e,1.25:i,1.26:b,1.26:e,1.26:h,1.26:i,1.26:k,1.28:g,1.32:d,1.34:b,1.34:e,1.36:d,1.36:g,1.36:h,1.36:k,1.42:d,1.42:f,1.42:i,1.42:n,1.42:o,1.42:t,2.46:c,2.46:j,2.48:c,2.48:d,2.48:g,2.48:n,2.50:c,2.50:g,2.50:k,2.50:p,3.54:d,and avoid the version *:l,*:g,1.00,1.01,1.20,1.20:f,1.25,1.25:e,1.25:i,1.26:b,1.26:e,1.26:h,1.26:i,1.26:k,1.28:g,1.32:d,1.34:b,1.34:e,1.36:d,1.36:g,1.36:h,1.36:k,1.42:d,1.42:f,1.42:i,1.42:n,1.42:o,1.42:t,2.46:c,2.46:j,2.48:c,2.48:d,2.48:g,2.48:n,2.50:c,2.50:g,2.50:k,2.50:p,3.54:d