CVE-2017-1500

Severity: medium (CVSS 6.1 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.8% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2017-08-01 · updated 2026-06-17
Weakness: CWE-79

Description

A Reflected Cross Site Scripting (XSS) vulnerability exists in the authorization function exposed by RESTful Web Api of IBM Worklight Framework 6.1, 6.2, 6.3, 7.0, 7.1, and 8.0. The vulnerable parameter is "scope"; if you set as its value a "realm" not defined in authenticationConfig.xml, you get an HTTP 403 Forbidden response and the value will be reflected in the body of the HTTP response. By setting it to arbitrary JavaScript code it is possible to modify the flow of the authorization function, potentially leading to credential disclosure within a trusted session.

Affected products

IBM MobileFirst Platform Foundation: 6.3.0.0, 7.0.0.0, 7.1.0.0, 8.0.0.0
IBM Worklight: 6.1.0.2, 6.2.0.1

References

Get alerted when CVE-2017-1500 or the next vulnerability affects your stack