Advisory Information

  • Title: IBM Atlas Suite cross-site scripting (XSS) vulnerabilities
  • Advisory ID: SWRX-2014-009
  • Date published: Friday, August 15, 2014
  • CVE: CVE-2014-0889
  • CVSS v2 base score: 3.5
  • Date of last update: Friday, August 15, 2014
  • Vendors contacted: IBM Corporation
  • Release mode: Coordinated
  • Discovered by: Craig Lambert, Dell SecureWorks


The IBM Atlas Suite/Atlas Policy Suite is a solution portfolio that retains and archives information, meets eDiscovery obligations, and defensibly disposes of information to lower customers' cost and risk. This software contains multiple reflected cross-site scripting (XSS) vulnerabilities due to insufficient input validation of URL parameters. Successful exploitation may allow an attacker to retrieve session cookies, steal recently submitted data, or launch additional attacks.

Download the PDF: SWRX-2014-009

PGP Signature