CVEvulnerability

CVE-2006-2431

4.3 MEDIUM Published 2006-05-17 Modified 2026-06-16 Official page ↗
Status
Modified
Published
2006-05-17
Last modified
2026-06-16
Assigner
[email protected]
CVSS 2.0 ([email protected])
4.3 MEDIUM — AV:N/AC:M/Au:N/C:N/I:P/A:N
Weaknesses
CWE-79

Description

Cross-site scripting (XSS) vulnerability in the 500 Internal Server Error page on the SOAP port (8880/tcp) in IBM WebSphere Application Server 5.0.2 and earlier, 5.1.x before 5.1.1.12, and 6.0.2 up to 6.0.2.7, allows remote attackers to inject arbitrary web script or HTML via the URI, which is contained in a FAULTACTOR element on this page. NOTE: some sources have reported the element as "faultfactor," but this is likely erroneous.

Affected configurations

• ibm websphere application server 5.0.0 • ibm websphere application server 5.0.1 • ibm websphere application server 5.0.2 • ibm websphere application server 5.1.0 • ibm websphere application server 5.1.0.2 • ibm websphere application server 5.1.0.3 • ibm websphere application server 5.1.0.4 • ibm websphere application server 5.1.0.5 • ibm websphere application server 5.1.1 • ibm websphere application server 5.1.1.1 • ibm websphere application server 5.1.1.10 • ibm websphere application server 5.1.1.11 • ibm websphere application server 6.0.2 • ibm websphere application server 6.0.2.1 • ibm websphere application server 6.0.2.2 • ibm websphere application server 6.0.2.3 • ibm websphere application server 6.0.2.4 • ibm websphere application server 6.0.2.5 • ibm websphere application server 6.0.2.6 • ibm websphere application server 6.0.2.7

Related

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References