CVE-2013-0499
Estado: ModificadaMedia (4.3)—
Cross-site scripting (XSS) vulnerability in the echo functionality on IBM WebSphere DataPower SOA appliances with firmware 3.8.2, 4.0, 4.0.1, 4.0.2, and 5.0.0 allows remote attackers to inject arbitrary web script or HTML via a SOAP message, as demonstrated by the XML Firewall, Multi Protocol Gateway (MPGW), Web Service Proxy, and Web Token services.
CVSS
- Versión: 2.0
- Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N
- Puntuación base: 4.3
Probabilidad de explotación (EPSS)
- Probabilidad de explotación en los próximos 30 días: 1.21%
- Percentil entre todas las CVEs puntuadas: 67
- Fecha de la puntuación: 6/10/2026
EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).
Tecnologías afectadas (14)
IBM — Websphere Datapower B2B Appliance Xb62IBM — Websphere Datapower B2B Appliance Xb62 FirmwareIBM — Websphere Datapower Integration Appliance Xi50IBM — Websphere Datapower Integration Appliance Xi50 FirmwareIBM — Websphere Datapower Integration Appliance Xi52IBM — Websphere Datapower Integration Appliance Xi52 FirmwareIBM — Websphere Datapower Integration Appliance Xi52 Virtual EditionIBM — Websphere Datapower Integration Appliance Xi52 Virtual Edition FirmwareIBM — Websphere Datapower Service Gateway Xg45IBM — Websphere Datapower Service Gateway Xg45 FirmwareIBM — Websphere Datapower Service Gateway Xg45 Virtual EditionIBM — Websphere Datapower Service Gateway Xg45 Virtual Edition FirmwareIBM — Websphere Datapower Xc10 ApplianceIBM — Websphere Datapower Xc10 Appliance Firmware
CWE
- CWE-79
Referencias
- http://seclists.org/bugtraq/2013/May/83
- http://www-01.ibm.com/support/docview.wss?uid=swg21637717
- https://exchange.xforce.ibmcloud.com/vulnerabilities/82221
- https://www.sec-consult.com/fxdata/seccons/prod/temedia/advisories_txt/20130523-0_IBM_Xi50_Echo-WebService_Xss_in_Xml_v10.txt
- http://seclists.org/bugtraq/2013/May/83
- http://www-01.ibm.com/support/docview.wss?uid=swg21637717
- https://exchange.xforce.ibmcloud.com/vulnerabilities/82221
- https://www.sec-consult.com/fxdata/seccons/prod/temedia/advisories_txt/20130523-0_IBM_Xi50_Echo-WebService_Xss_in_Xml_v10.txt
JSON original (NVD)
Mostrar
{
"id": "CVE-2013-0499",
"cveTags": [],
"metrics": {
"cvssMetricV2": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"cvssData": {
"version": "2.0",
"baseScore": 4.3,
"accessVector": "NETWORK",
"vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
"authentication": "NONE",
"integrityImpact": "PARTIAL",
"accessComplexity": "MEDIUM",
"availabilityImpact": "NONE",
"confidentialityImpact": "NONE"
},
"acInsufInfo": false,
"impactScore": 2.9,
"baseSeverity": "MEDIUM",
"obtainAllPrivilege": false,
"exploitabilityScore": 8.6,
"obtainUserPrivilege": false,
"obtainOtherPrivilege": false,
"userInteractionRequired": true
}
]
},
"affected": [
{
"source": "psirt@us.ibm.com",
"affectedData": [
{
"vendor": "n/a",
"product": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
]
}
],
"published": "2013-05-28T16:55:01.133",
"references": [
{
"url": "http://seclists.org/bugtraq/2013/May/83",
"tags": [
"Exploit"
],
"source": "psirt@us.ibm.com"
},
{
"url": "http://www-01.ibm.com/support/docview.wss?uid=swg21637717",
"tags": [
"Vendor Advisory"
],
"source": "psirt@us.ibm.com"
},
{
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/82221",
"source": "psirt@us.ibm.com"
},
{
"url": "https://www.sec-consult.com/fxdata/seccons/prod/temedia/advisories_txt/20130523-0_IBM_Xi50_Echo-WebService_Xss_in_Xml_v10.txt",
"tags": [
"Exploit"
],
"source": "psirt@us.ibm.com"
},
{
"url": "http://seclists.org/bugtraq/2013/May/83",
"tags": [
"Exploit"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "http://www-01.ibm.com/support/docview.wss?uid=swg21637717",
"tags": [
"Vendor Advisory"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/82221",
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://www.sec-consult.com/fxdata/seccons/prod/temedia/advisories_txt/20130523-0_IBM_Xi50_Echo-WebService_Xss_in_Xml_v10.txt",
"tags": [
"Exploit"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
}
],
"vulnStatus": "Modified",
"weaknesses": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"description": [
{
"lang": "en",
"value": "CWE-79"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Cross-site scripting (XSS) vulnerability in the echo functionality on IBM WebSphere DataPower SOA appliances with firmware 3.8.2, 4.0, 4.0.1, 4.0.2, and 5.0.0 allows remote attackers to inject arbitrary web script or HTML via a SOAP message, as demonstrated by the XML Firewall, Multi Protocol Gateway (MPGW), Web Service Proxy, and Web Token services."
},
{
"lang": "es",
"value": "Una vulnerabilidad de tipo cross-site scripting (XSS) en la funcionalidad echo en dispositivos SOA WebSphere DataPower de IBM con la versión de firmware 3.8.2, 4.0, 4.0.1, 4.0.2 y 5.0.0, permite a los atacantes remotos inyectar script web o HTML arbitrarios por medio de un mensaje SOAP, como es demostrado por los servicios Firewall XML, Multi Protocol Gateway (MPGW), Proxy de servicio web y Token web."
}
],
"lastModified": "2026-06-16T23:49:35.370",
"configurations": [
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:ibm:websphere_datapower_xc10_appliance_firmware:3.8.2:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "52EF1C54-93CD-4B24-B553-0959A3816849"
},
{
"criteria": "cpe:2.3:o:ibm:websphere_datapower_xc10_appliance_firmware:4.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "91AC9EFB-90F4-4608-9C36-CDE03234CE34"
},
{
"criteria": "cpe:2.3:o:ibm:websphere_datapower_xc10_appliance_firmware:4.0.1:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "AE42F365-E83B-4DA8-B84A-E81F77CC63B6"
},
{
"criteria": "cpe:2.3:o:ibm:websphere_datapower_xc10_appliance_firmware:4.0.2:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "D25888C5-0200-4124-AE4F-D1989B9D0943"
},
{
"criteria": "cpe:2.3:o:ibm:websphere_datapower_xc10_appliance_firmware:5.0.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "AB499F52-5A18-40F9-A63A-A7C0E2A79D2D"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:ibm:websphere_datapower_xc10_appliance:-:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "50016031-DAFB-420A-BC46-66C8D89681F4"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:ibm:websphere_datapower_service_gateway_xg45_virtual_edition_firmware:3.8.2:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "C8DC137A-40F9-4E81-AE46-D1A512533FD1"
},
{
"criteria": "cpe:2.3:o:ibm:websphere_datapower_service_gateway_xg45_virtual_edition_firmware:4.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "5E83E70F-AB49-43F7-A873-A1C6B5429E1A"
},
{
"criteria": "cpe:2.3:o:ibm:websphere_datapower_service_gateway_xg45_virtual_edition_firmware:4.0.1:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "68324EA4-89EA-4752-B39D-DA13B7FC39A8"
},
{
"criteria": "cpe:2.3:o:ibm:websphere_datapower_service_gateway_xg45_virtual_edition_firmware:4.0.2:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "85315EC4-FCAF-44CC-8BF9-C85CAD3637BA"
},
{
"criteria": "cpe:2.3:o:ibm:websphere_datapower_service_gateway_xg45_virtual_edition_firmware:5.0.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "EF697743-6F1C-4C98-9EA2-E1EE1E7963CB"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:ibm:websphere_datapower_service_gateway_xg45_virtual_edition:-:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "0434DBE4-7EE5-4A9D-AB44-02DC114BBD55"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:ibm:websphere_datapower_service_gateway_xg45_firmware:3.8.2:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "6BEC2F83-9C7F-44D9-A75B-BC5CDBCD61D5"
},
{
"criteria": "cpe:2.3:o:ibm:websphere_datapower_service_gateway_xg45_firmware:4.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "2C1AE21E-2D17-44F9-A116-4A162DEA8F60"
},
{
"criteria": "cpe:2.3:o:ibm:websphere_datapower_service_gateway_xg45_firmware:4.0.1:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "11817A12-ED84-4EF4-97CF-F8EB95F7196A"
},
{
"criteria": "cpe:2.3:o:ibm:websphere_datapower_service_gateway_xg45_firmware:4.0.2:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "F0B9D60E-8218-4A58-9DD3-CF4D8AEF7914"
},
{
"criteria": "cpe:2.3:o:ibm:websphere_datapower_service_gateway_xg45_firmware:5.0.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "F7D77730-2F0E-4046-942F-ACDCF4C16439"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:ibm:websphere_datapower_service_gateway_xg45:-:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "7C6AC122-7C0B-42B3-B9FB-1E1F4E3C31FF"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:ibm:websphere_datapower_integration_appliance_xi52_virtual_edition_firmware:3.8.2:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "F9EBDAA7-4D20-4328-A4D7-19C5493A9EDB"
},
{
"criteria": "cpe:2.3:o:ibm:websphere_datapower_integration_appliance_xi52_virtual_edition_firmware:4.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "5586C7C0-315B-4F3E-921B-30260A5A6238"
},
{
"criteria": "cpe:2.3:o:ibm:websphere_datapower_integration_appliance_xi52_virtual_edition_firmware:4.0.1:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "5ED9C5A0-274C-4CAF-84E2-3A59B48C890C"
},
{
"criteria": "cpe:2.3:o:ibm:websphere_datapower_integration_appliance_xi52_virtual_edition_firmware:4.0.2:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "126DDB17-7D0A-426C-9CC2-EFED785E8CDC"
},
{
"criteria": "cpe:2.3:o:ibm:websphere_datapower_integration_appliance_xi52_virtual_edition_firmware:5.0.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "ED6E2091-AEC2-43FD-A5D3-B6F805C95CD7"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:ibm:websphere_datapower_integration_appliance_xi52_virtual_edition:-:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "F8E7E192-0494-498C-BF20-7C2AF3102D0B"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:ibm:websphere_datapower_integration_appliance_xi52_firmware:3.8.2:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "2346457F-39BA-407E-8451-D44FB947757E"
},
{
"criteria": "cpe:2.3:o:ibm:websphere_datapower_integration_appliance_xi52_firmware:4.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "A592E7D9-B5B8-45DD-AAF0-E380F7511AA4"
},
{
"criteria": "cpe:2.3:o:ibm:websphere_datapower_integration_appliance_xi52_firmware:4.0.1:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "A570957F-5B26-46FD-B51B-E90C96EB4168"
},
{
"criteria": "cpe:2.3:o:ibm:websphere_datapower_integration_appliance_xi52_firmware:4.0.2:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "04EFE5AD-4652-4254-8AE9-D06F3453A808"
},
{
"criteria": "cpe:2.3:o:ibm:websphere_datapower_integration_appliance_xi52_firmware:5.0.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "AD176549-564F-49E8-9FDA-F4C263E5817F"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:ibm:websphere_datapower_integration_appliance_xi52:-:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "137D5F48-9118-4C2D-941A-8AEB48567443"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:ibm:websphere_datapower_integration_appliance_xi50_firmware:3.8.2:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "AB95DC9D-D74B-45E1-AFB0-80F7A1F46FA9"
},
{
"criteria": "cpe:2.3:o:ibm:websphere_datapower_integration_appliance_xi50_firmware:4.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "0833251B-E8A5-4E4A-B7CC-700E205509FE"
},
{
"criteria": "cpe:2.3:o:ibm:websphere_datapower_integration_appliance_xi50_firmware:4.0.1:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "DD789CDF-5F99-4FD3-ADE2-36297310EADA"
},
{
"criteria": "cpe:2.3:o:ibm:websphere_datapower_integration_appliance_xi50_firmware:4.0.2:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "CF02EAA9-1CDA-4C8C-AF34-E133AA3497D5"
},
{
"criteria": "cpe:2.3:o:ibm:websphere_datapower_integration_appliance_xi50_firmware:5.0.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "2E6B0888-C558-48EF-9C1B-4E169ECC70AD"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:ibm:websphere_datapower_integration_appliance_xi50:-:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "2EBB66F8-B497-404C-813A-A40E853054D6"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:ibm:websphere_datapower_b2b_appliance_xb62_firmware:3.8.2:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "357A5629-DF00-483B-BD8F-CCD05CF8CFA8"
},
{
"criteria": "cpe:2.3:o:ibm:websphere_datapower_b2b_appliance_xb62_firmware:4.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "122283E7-E514-4ED7-9529-A75CF236855B"
},
{
"criteria": "cpe:2.3:o:ibm:websphere_datapower_b2b_appliance_xb62_firmware:4.0.1:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "716DBA1D-16EE-4E87-BA6B-A444981392BB"
},
{
"criteria": "cpe:2.3:o:ibm:websphere_datapower_b2b_appliance_xb62_firmware:4.0.2:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "513606F6-9E5C-45E9-86AE-332F1EDC06D3"
},
{
"criteria": "cpe:2.3:o:ibm:websphere_datapower_b2b_appliance_xb62_firmware:5.0.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "390A7634-FDD9-4FB9-8641-31AB41168E85"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:ibm:websphere_datapower_b2b_appliance_xb62:-:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "5257F9FA-F807-4D15-BF7C-8A9531619A50"
}
],
"operator": "OR"
}
],
"operator": "AND"
}
],
"sourceIdentifier": "psirt@us.ibm.com"
}