CVE-2014-6196

Severity: medium (CVSS 4.3 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2014-11-26 · updated 2026-06-17
Weakness: CWE-79

Description

Cross-site scripting (XSS) vulnerability in IBM Web Experience Factory (WEF) 6.1.5 through 8.5.0.1, as used in WebSphere Dashboard Framework (WDF) and Lotus Widget Factory (LWF), allows remote attackers to inject arbitrary web script or HTML by leveraging a Dojo builder error in an unspecified WebSphere Portal configuration, leading to improper construction of a response page by an application.

Affected products

IBM Web Experience Factory: 6.1.5, 7.0.1, 7.0.1.1, 7.0.1.2, 7.0.1.3, 7.0.1.4 (+7)

References

http://secunia.com/advisories/59546
http://www-01.ibm.com/support/docview.wss?uid=swg1LO82672
http://www-01.ibm.com/support/docview.wss?uid=swg1LO82673
http://www-01.ibm.com/support/docview.wss?uid=swg1LO82674
http://www-01.ibm.com/support/docview.wss?uid=swg1LO82675
http://www-01.ibm.com/support/docview.wss?uid=swg1LO82676
http://www-01.ibm.com/support/docview.wss?uid=swg21690018
https://exchange.xforce.ibmcloud.com/vulnerabilities/98608
http://secunia.com/advisories/59546
http://www-01.ibm.com/support/docview.wss?uid=swg1LO82672
http://www-01.ibm.com/support/docview.wss?uid=swg1LO82673
http://www-01.ibm.com/support/docview.wss?uid=swg1LO82674

Get alerted when CVE-2014-6196 or the next vulnerability affects your stack