CVE-2002-1168 — MEDIUM (6.8)

Vulnerability Description

Cross-site scripting (XSS) vulnerability in IBM Web Traffic Express Caching Proxy Server 3.6 and 4.x before 4.0.1.26 allows remote attackers to execute script as other users via an HTTP request that contains an Location: header with a "%0a%0d" (CRLF) sequence, which echoes the Location as an HTTP header in the server response.

CVSS Score

6.8

MEDIUM

AV:N/AC:M/Au:N/C:P/I:P/A:P

Confidentiality

PARTIAL

Integrity

PARTIAL

Availability

PARTIAL

Affected Products

Vendor	Product	Versions
Ibm	Websphere Caching Proxy Server	3.6

References

http://www.iss.net/security_center/static/10454.phpVendor Advisory
http://www.securityfocus.com/bid/6001
http://www.iss.net/security_center/static/10454.phpVendor Advisory
http://www.securityfocus.com/bid/6001

FAQ

What is CVE-2002-1168?

CVE-2002-1168 is a vulnerability with a CVSS score of 6.8 (MEDIUM). Cross-site scripting (XSS) vulnerability in IBM Web Traffic Express Caching Proxy Server 3.6 and 4.x before 4.0.1.26 allows remote attackers to execute script as other users via an HTTP request that c...

How severe is CVE-2002-1168?

CVE-2002-1168 has been rated MEDIUM with a CVSS base score of 6.8/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2002-1168?

Check the references section above for vendor advisories and patch information. Affected products include: Ibm Websphere Caching Proxy Server.