CVE-2013-0499
Status: ModifiedMedium (4.3)—
Cross-site scripting (XSS) vulnerability in the echo functionality on IBM WebSphere DataPower SOA appliances with firmware 3.8.2, 4.0, 4.0.1, 4.0.2, and 5.0.0 allows remote attackers to inject arbitrary web script or HTML via a SOAP message, as demonstrated by the XML Firewall, Multi Protocol Gateway (MPGW), Web Service Proxy, and Web Token services.
CVSS
- Version: 2.0
- Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N
- Base score: 4.3
Exploitation probability (EPSS)
- Probability of exploitation in the next 30 days: 1.21%
- Percentile among all scored CVEs: 67
- Score date: 10/6/2026
EPSS (Exploit Prediction Scoring System, FIRST) estimates how likely a vulnerability is to be exploited in the wild within 30 days. It complements CVSS (impact) and CISA KEV (confirmed exploitation).
Affected technologies (14)
IBM — Websphere Datapower B2B Appliance Xb62IBM — Websphere Datapower B2B Appliance Xb62 FirmwareIBM — Websphere Datapower Integration Appliance Xi50IBM — Websphere Datapower Integration Appliance Xi50 FirmwareIBM — Websphere Datapower Integration Appliance Xi52IBM — Websphere Datapower Integration Appliance Xi52 FirmwareIBM — Websphere Datapower Integration Appliance Xi52 Virtual EditionIBM — Websphere Datapower Integration Appliance Xi52 Virtual Edition FirmwareIBM — Websphere Datapower Service Gateway Xg45IBM — Websphere Datapower Service Gateway Xg45 FirmwareIBM — Websphere Datapower Service Gateway Xg45 Virtual EditionIBM — Websphere Datapower Service Gateway Xg45 Virtual Edition FirmwareIBM — Websphere Datapower Xc10 ApplianceIBM — Websphere Datapower Xc10 Appliance Firmware
CWEs
- CWE-79
References
- http://seclists.org/bugtraq/2013/May/83
- http://www-01.ibm.com/support/docview.wss?uid=swg21637717
- https://exchange.xforce.ibmcloud.com/vulnerabilities/82221
- https://www.sec-consult.com/fxdata/seccons/prod/temedia/advisories_txt/20130523-0_IBM_Xi50_Echo-WebService_Xss_in_Xml_v10.txt
- http://seclists.org/bugtraq/2013/May/83
- http://www-01.ibm.com/support/docview.wss?uid=swg21637717
- https://exchange.xforce.ibmcloud.com/vulnerabilities/82221
- https://www.sec-consult.com/fxdata/seccons/prod/temedia/advisories_txt/20130523-0_IBM_Xi50_Echo-WebService_Xss_in_Xml_v10.txt
Raw JSON (NVD)
Show
{
"id": "CVE-2013-0499",
"cveTags": [],
"metrics": {
"cvssMetricV2": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"cvssData": {
"version": "2.0",
"baseScore": 4.3,
"accessVector": "NETWORK",
"vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
"authentication": "NONE",
"integrityImpact": "PARTIAL",
"accessComplexity": "MEDIUM",
"availabilityImpact": "NONE",
"confidentialityImpact": "NONE"
},
"acInsufInfo": false,
"impactScore": 2.9,
"baseSeverity": "MEDIUM",
"obtainAllPrivilege": false,
"exploitabilityScore": 8.6,
"obtainUserPrivilege": false,
"obtainOtherPrivilege": false,
"userInteractionRequired": true
}
]
},
"affected": [
{
"source": "psirt@us.ibm.com",
"affectedData": [
{
"vendor": "n/a",
"product": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
]
}
],
"published": "2013-05-28T16:55:01.133",
"references": [
{
"url": "http://seclists.org/bugtraq/2013/May/83",
"tags": [
"Exploit"
],
"source": "psirt@us.ibm.com"
},
{
"url": "http://www-01.ibm.com/support/docview.wss?uid=swg21637717",
"tags": [
"Vendor Advisory"
],
"source": "psirt@us.ibm.com"
},
{
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/82221",
"source": "psirt@us.ibm.com"
},
{
"url": "https://www.sec-consult.com/fxdata/seccons/prod/temedia/advisories_txt/20130523-0_IBM_Xi50_Echo-WebService_Xss_in_Xml_v10.txt",
"tags": [
"Exploit"
],
"source": "psirt@us.ibm.com"
},
{
"url": "http://seclists.org/bugtraq/2013/May/83",
"tags": [
"Exploit"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "http://www-01.ibm.com/support/docview.wss?uid=swg21637717",
"tags": [
"Vendor Advisory"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/82221",
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://www.sec-consult.com/fxdata/seccons/prod/temedia/advisories_txt/20130523-0_IBM_Xi50_Echo-WebService_Xss_in_Xml_v10.txt",
"tags": [
"Exploit"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
}
],
"vulnStatus": "Modified",
"weaknesses": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"description": [
{
"lang": "en",
"value": "CWE-79"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Cross-site scripting (XSS) vulnerability in the echo functionality on IBM WebSphere DataPower SOA appliances with firmware 3.8.2, 4.0, 4.0.1, 4.0.2, and 5.0.0 allows remote attackers to inject arbitrary web script or HTML via a SOAP message, as demonstrated by the XML Firewall, Multi Protocol Gateway (MPGW), Web Service Proxy, and Web Token services."
},
{
"lang": "es",
"value": "Una vulnerabilidad de tipo cross-site scripting (XSS) en la funcionalidad echo en dispositivos SOA WebSphere DataPower de IBM con la versión de firmware 3.8.2, 4.0, 4.0.1, 4.0.2 y 5.0.0, permite a los atacantes remotos inyectar script web o HTML arbitrarios por medio de un mensaje SOAP, como es demostrado por los servicios Firewall XML, Multi Protocol Gateway (MPGW), Proxy de servicio web y Token web."
}
],
"lastModified": "2026-06-16T23:49:35.370",
"configurations": [
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:ibm:websphere_datapower_xc10_appliance_firmware:3.8.2:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "52EF1C54-93CD-4B24-B553-0959A3816849"
},
{
"criteria": "cpe:2.3:o:ibm:websphere_datapower_xc10_appliance_firmware:4.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "91AC9EFB-90F4-4608-9C36-CDE03234CE34"
},
{
"criteria": "cpe:2.3:o:ibm:websphere_datapower_xc10_appliance_firmware:4.0.1:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "AE42F365-E83B-4DA8-B84A-E81F77CC63B6"
},
{
"criteria": "cpe:2.3:o:ibm:websphere_datapower_xc10_appliance_firmware:4.0.2:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "D25888C5-0200-4124-AE4F-D1989B9D0943"
},
{
"criteria": "cpe:2.3:o:ibm:websphere_datapower_xc10_appliance_firmware:5.0.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "AB499F52-5A18-40F9-A63A-A7C0E2A79D2D"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:ibm:websphere_datapower_xc10_appliance:-:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "50016031-DAFB-420A-BC46-66C8D89681F4"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:ibm:websphere_datapower_service_gateway_xg45_virtual_edition_firmware:3.8.2:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "C8DC137A-40F9-4E81-AE46-D1A512533FD1"
},
{
"criteria": "cpe:2.3:o:ibm:websphere_datapower_service_gateway_xg45_virtual_edition_firmware:4.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "5E83E70F-AB49-43F7-A873-A1C6B5429E1A"
},
{
"criteria": "cpe:2.3:o:ibm:websphere_datapower_service_gateway_xg45_virtual_edition_firmware:4.0.1:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "68324EA4-89EA-4752-B39D-DA13B7FC39A8"
},
{
"criteria": "cpe:2.3:o:ibm:websphere_datapower_service_gateway_xg45_virtual_edition_firmware:4.0.2:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "85315EC4-FCAF-44CC-8BF9-C85CAD3637BA"
},
{
"criteria": "cpe:2.3:o:ibm:websphere_datapower_service_gateway_xg45_virtual_edition_firmware:5.0.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "EF697743-6F1C-4C98-9EA2-E1EE1E7963CB"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:ibm:websphere_datapower_service_gateway_xg45_virtual_edition:-:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "0434DBE4-7EE5-4A9D-AB44-02DC114BBD55"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:ibm:websphere_datapower_service_gateway_xg45_firmware:3.8.2:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "6BEC2F83-9C7F-44D9-A75B-BC5CDBCD61D5"
},
{
"criteria": "cpe:2.3:o:ibm:websphere_datapower_service_gateway_xg45_firmware:4.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "2C1AE21E-2D17-44F9-A116-4A162DEA8F60"
},
{
"criteria": "cpe:2.3:o:ibm:websphere_datapower_service_gateway_xg45_firmware:4.0.1:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "11817A12-ED84-4EF4-97CF-F8EB95F7196A"
},
{
"criteria": "cpe:2.3:o:ibm:websphere_datapower_service_gateway_xg45_firmware:4.0.2:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "F0B9D60E-8218-4A58-9DD3-CF4D8AEF7914"
},
{
"criteria": "cpe:2.3:o:ibm:websphere_datapower_service_gateway_xg45_firmware:5.0.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "F7D77730-2F0E-4046-942F-ACDCF4C16439"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:ibm:websphere_datapower_service_gateway_xg45:-:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "7C6AC122-7C0B-42B3-B9FB-1E1F4E3C31FF"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:ibm:websphere_datapower_integration_appliance_xi52_virtual_edition_firmware:3.8.2:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "F9EBDAA7-4D20-4328-A4D7-19C5493A9EDB"
},
{
"criteria": "cpe:2.3:o:ibm:websphere_datapower_integration_appliance_xi52_virtual_edition_firmware:4.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "5586C7C0-315B-4F3E-921B-30260A5A6238"
},
{
"criteria": "cpe:2.3:o:ibm:websphere_datapower_integration_appliance_xi52_virtual_edition_firmware:4.0.1:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "5ED9C5A0-274C-4CAF-84E2-3A59B48C890C"
},
{
"criteria": "cpe:2.3:o:ibm:websphere_datapower_integration_appliance_xi52_virtual_edition_firmware:4.0.2:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "126DDB17-7D0A-426C-9CC2-EFED785E8CDC"
},
{
"criteria": "cpe:2.3:o:ibm:websphere_datapower_integration_appliance_xi52_virtual_edition_firmware:5.0.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "ED6E2091-AEC2-43FD-A5D3-B6F805C95CD7"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:ibm:websphere_datapower_integration_appliance_xi52_virtual_edition:-:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "F8E7E192-0494-498C-BF20-7C2AF3102D0B"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:ibm:websphere_datapower_integration_appliance_xi52_firmware:3.8.2:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "2346457F-39BA-407E-8451-D44FB947757E"
},
{
"criteria": "cpe:2.3:o:ibm:websphere_datapower_integration_appliance_xi52_firmware:4.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "A592E7D9-B5B8-45DD-AAF0-E380F7511AA4"
},
{
"criteria": "cpe:2.3:o:ibm:websphere_datapower_integration_appliance_xi52_firmware:4.0.1:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "A570957F-5B26-46FD-B51B-E90C96EB4168"
},
{
"criteria": "cpe:2.3:o:ibm:websphere_datapower_integration_appliance_xi52_firmware:4.0.2:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "04EFE5AD-4652-4254-8AE9-D06F3453A808"
},
{
"criteria": "cpe:2.3:o:ibm:websphere_datapower_integration_appliance_xi52_firmware:5.0.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "AD176549-564F-49E8-9FDA-F4C263E5817F"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:ibm:websphere_datapower_integration_appliance_xi52:-:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "137D5F48-9118-4C2D-941A-8AEB48567443"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:ibm:websphere_datapower_integration_appliance_xi50_firmware:3.8.2:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "AB95DC9D-D74B-45E1-AFB0-80F7A1F46FA9"
},
{
"criteria": "cpe:2.3:o:ibm:websphere_datapower_integration_appliance_xi50_firmware:4.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "0833251B-E8A5-4E4A-B7CC-700E205509FE"
},
{
"criteria": "cpe:2.3:o:ibm:websphere_datapower_integration_appliance_xi50_firmware:4.0.1:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "DD789CDF-5F99-4FD3-ADE2-36297310EADA"
},
{
"criteria": "cpe:2.3:o:ibm:websphere_datapower_integration_appliance_xi50_firmware:4.0.2:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "CF02EAA9-1CDA-4C8C-AF34-E133AA3497D5"
},
{
"criteria": "cpe:2.3:o:ibm:websphere_datapower_integration_appliance_xi50_firmware:5.0.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "2E6B0888-C558-48EF-9C1B-4E169ECC70AD"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:ibm:websphere_datapower_integration_appliance_xi50:-:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "2EBB66F8-B497-404C-813A-A40E853054D6"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:ibm:websphere_datapower_b2b_appliance_xb62_firmware:3.8.2:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "357A5629-DF00-483B-BD8F-CCD05CF8CFA8"
},
{
"criteria": "cpe:2.3:o:ibm:websphere_datapower_b2b_appliance_xb62_firmware:4.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "122283E7-E514-4ED7-9529-A75CF236855B"
},
{
"criteria": "cpe:2.3:o:ibm:websphere_datapower_b2b_appliance_xb62_firmware:4.0.1:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "716DBA1D-16EE-4E87-BA6B-A444981392BB"
},
{
"criteria": "cpe:2.3:o:ibm:websphere_datapower_b2b_appliance_xb62_firmware:4.0.2:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "513606F6-9E5C-45E9-86AE-332F1EDC06D3"
},
{
"criteria": "cpe:2.3:o:ibm:websphere_datapower_b2b_appliance_xb62_firmware:5.0.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "390A7634-FDD9-4FB9-8641-31AB41168E85"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:ibm:websphere_datapower_b2b_appliance_xb62:-:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "5257F9FA-F807-4D15-BF7C-8A9531619A50"
}
],
"operator": "OR"
}
],
"operator": "AND"
}
],
"sourceIdentifier": "psirt@us.ibm.com"
}