Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2013-0571: IBM Document Connect lets attackers run malicious scripts via URL

CVE-2013-0571 · published 13 years ago

Summary

The IBM Document Connect component in Application Support Facility can be tricked into executing unwanted web code when a specially crafted link is visited. This could let an attacker display false information or steal data from users of the system. Update to the latest version of Document Connect to stop this behavior.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software

Vendor	Product	Affected versions
ibm	application_support_facility	3.4.0 `cpe:2.3:a:ibm:application_support_facility:3.4.0:-::::aix::*`
ibm	document_connect_for_application_support_facility	<= 1.0.0.1204 `cpe:2.3:a:ibm:document_connect_for_application_support_facility::::::::`

Original advisory text

Cross-site scripting (XSS) vulnerability in IBM Document Connect for Application Support Facility (aka DC4ASF) before 1.0.0.1218 in Application Support Facility (ASF) 3.4 for z/OS on Windows, Linux, and AIX allows remote attackers to inject arbitrary web script or HTML via a crafted URL.

References

Fix within

Internet-facing 60 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit (estimated)
Gives an attacker partial control (estimated)

Severity

2.9 Low

Exploitation

<1% chance of attack within 30 days

Type

CWE-79Cross-site Scripting (XSS)

Timeline

Published27 Apr 2013

Updated4 Nov 2026

First seen29 Sep 2026

Sources

CVE-2013-0571 · NVD

Track software like this

Free during beta