CVE-2012-3296

Severity: medium (CVSS 4.3 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.6% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2012-08-17 · updated 2026-06-16
Weakness: CWE-79

Description

Cross-site scripting (XSS) vulnerability in the Help link in the login panel in IBM Power Hardware Management Console (HMC) 7R7.1.0 before SP4, 7R7.2.0 before SP2, and 7R7.3.0 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

Affected products

IBM Power HMC: 7r7.1.0, 7r7.1.0-sp0, 7r7.1.0-sp1, 7r7.1.0-sp2, 7r7.1.0-sp3, 7r7.2.0 (+3)

References

http://secunia.com/advisories/50376
http://www.ibm.com/connections/blogs/PSIRT/entry/security_bulletin_the_help_link_on_the_power_hmc_login_panel_is_susceptible_to_reflected_cross_site_scripting_cve_2012_329617
http://www.ibm.com/support/docview.wss?uid=isg1MB03488
http://www.ibm.com/support/docview.wss?uid=isg1MB03489
http://www.ibm.com/support/docview.wss?uid=isg1MB03494
http://www.ibm.com/support/fixcentral/firmware/readme?fixid=MH01253
http://www.ibm.com/support/fixcentral/firmware/readme?fixid=MH01257
http://www.ibm.com/support/fixcentral/firmware/readme?fixid=MH01258
http://www.securitytracker.com/id?1027433
https://exchange.xforce.ibmcloud.com/vulnerabilities/77288
http://secunia.com/advisories/50376
http://www.ibm.com/connections/blogs/PSIRT/entry/security_bulletin_the_help_link_on_the_power_hmc_login_panel_is_susceptible_to_reflected_cross_site_scripting_cve_2012_329617

Get alerted when CVE-2012-3296 or the next vulnerability affects your stack