Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
5.4

IBM Connections 6.0 lets attackers steal credentials via web page

CVE-2019-4403 · published 7 years ago
Summary

A weakness in the IBM Connections 6.0 web interface allows a user to place their own script code into pages that other users see. When a trusted user views the compromised page, the script can capture their login information. Apply the latest security update from IBM and ensure only trusted content is posted in the system.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
ibm connections 6.0
cpe:2.3:a:ibm:connections:6.0:*:*:*:*:*:*:*
Original advisory text
IBM Connections 6.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially lead...
IBM Connections 6.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 162264.
References
Fix within
Internet-facing 60 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit (estimated)
  • Gives an attacker partial control (estimated)
Severity
5.4 Medium
Exploitation
<1% chance of attack within 30 days
Type
CWE-79Cross-site Scripting (XSS)
Timeline
Published14 Jun 2019
Updated4 Nov 2026
First seen29 Sep 2026
Sources
CVE-2019-4403 · NVD
Track software like this
Free during beta