CVE-2015-5008

Cross-site scripting (XSS) vulnerability in IBM WebSphere Commerce 6.0 through FP11, 6.0 Feature Pack 4, 7.0 through FP9, 7.0 Feature Pack…

Medium6.1EPSS 1.7%

Published: 18 Jan 2016
Updated: 6 Aug 2024
Reserved: 24 Jun 2015
Assigned by: ibm

Description

Cross-site scripting (XSS) vulnerability in IBM WebSphere Commerce 6.0 through FP11, 6.0 Feature Pack 4, 7.0 through FP9, 7.0 Feature Pack 5 through 8, and 8.0 before 8.0.0.1 allows remote attackers to inject arbitrary web script or HTML via a crafted URL.

Scores

CVSS scores of CVE-2015-5008, by who scored it
Scored by	CVSS	Score	Vector
NVDNVD · Modified	3.0	Medium6.1	CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

EPSS (exploitation in 30 days): 1.7% · top 22% of all CVEs (5 Nov 2026)

The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 6.1.

Weakness

Affected products

n/a
- affected n/a

References (9)

http://www-01.ibm.com/support/docview.wss?uid=swg21972610 (opens in a new tab)x_refsource_CONFIRMx_transferred
JR54834 (opens in a new tab)vendor-advisoryx_refsource_AIXAPARx_transferred
JR54264 (opens in a new tab)vendor-advisoryx_refsource_AIXAPARx_transferred
JR54824 (opens in a new tab)vendor-advisoryx_refsource_AIXAPARx_transferred
1034695 (opens in a new tab)vdb-entryx_refsource_SECTRACKx_transferred
JR54432 (opens in a new tab)vendor-advisoryx_refsource_AIXAPARx_transferred
JR54265 (opens in a new tab)vendor-advisoryx_refsource_AIXAPARx_transferred
JR54899 (opens in a new tab)vendor-advisoryx_refsource_AIXAPARx_transferred
JR54825 (opens in a new tab)vendor-advisoryx_refsource_AIXAPARx_transferred

Sources

The same CVE in the primary databases and aggregators, to check against.

Badge for a README or a ticket

[![CVE-2015-5008](https://trackcve.app/badge/CVE-2015-5008.svg)](https://trackcve.app/cve/CVE-2015-5008)

Record last updated 6 Aug 2024, 06:32 UTC.