Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
3.5

IBM Lotus Protector for Mail Security admin UI allows script injection

CVE-2014-0884 · published 12 years ago
Summary

The web‑based administration console of IBM Lotus Protector for Mail Security (versions before the latest update) can be tricked by a logged‑in user into running their own web code. This could let an attacker change what appears on the page or steal session information. Apply the vendor's latest update to the product as soon as possible to close the gap.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
ibm lotus_protector_for_mail_security 2.8
2.8.1
cpe:2.3:a:ibm:lotus_protector_for_mail_security:2.8:*:*:*:*:*:*:*
Original advisory text
Cross-site scripting (XSS) vulnerability in the Admin Web UI in IBM Lotus Protector for Mail Security 2.8.x before 2.8.1-22905 allows remote authenticated users to inject arbitrary web script or HT...
Cross-site scripting (XSS) vulnerability in the Admin Web UI in IBM Lotus Protector for Mail Security 2.8.x before 2.8.1-22905 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.
References
Fix within
Internet-facing 60 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit (estimated)
  • Gives an attacker partial control (estimated)
Severity
3.5 Low
Exploitation
<1% chance of attack within 30 days
Type
CWE-79Cross-site Scripting (XSS)
Timeline
Published25 Mar 2014
Updated4 Nov 2026
First seen29 Sep 2026
Sources
CVE-2014-0884 · NVD
Track software like this
Free during beta