IBM has acknowledged a vulnerability in IBM Lotus Domino Web Server, which can be exploited by malicious users to conduct cross-site scripting attacks.

Certain unspecified input is not properly sanitised before being used. This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an affected site.

Successful exploitation requires that the "Domino Web server task (HTTP)" is enabled and the attacker can authenticate himself to the web server.

The vulnerability is reported in version 6.0, 6.5, and 7.0.

Solution
Update to version 6.5.6 Fix Pack 2 (FP2), 7.0.2 Fix Pack 2 (FP2), 7.0.3, or 8.0.

Provided and/or discovered by
IBM credits JPCERT/CC.

Changelog
Further details available in Customer Area

Original Advisory
IBM:
http://www-1.ibm.com/support/docview.wss?uid=swg21263871

IBM (KEMG6ZK34H):
http://www-1.ibm.com/support/docview.wss?uid=swg27010980

JPCERT/CC:
http://jvn.jp/jp/JVN%2384565055/index.html

Deep Links
Links available in Customer Area