Read the docs
TI-2010-03301 Aliases CVE-2010-3470GHSA-3gp9-pq9g-7grc

Multiple cross-site scripting (XSS) vulnerabilities in the Workplace (aka WP) component…

Priority LOW 23CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
— Not recorded in CVSS 2.0
Attack complexity
Medium
Impact type
Cross-site scripting
Confidentiality · integrity · availability
None · Partial · None
Fix status
No fix listed

Attack profile from CVSS 2.0 · NVD. Fix status from CNA. Impact type from CWE-79.

Summary

Multiple cross-site scripting (XSS) vulnerabilities in the Workplace (aka WP) component in IBM FileNet P8 Application Engine (P8AE) 3.5.1 before 3.5.1-021 and 4.0.2.x before 4.0.2.7-P8AE-FP007 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.

Why it matters now

EPSS 0.01292 70th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
  • — Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 28

CPEVersionsRoleVendor
cpe:2.3:a:ibm:filenet_p8_application_engine:3.5.1:*:*:*:*:*:*:*3.5.1VulnerableIBM
cpe:2.3:a:ibm:filenet_p8_application_engine:3.5.1:001:*:*:*:*:*:*3.5.1 001VulnerableIBM
cpe:2.3:a:ibm:filenet_p8_application_engine:3.5.1:002:*:*:*:*:*:*3.5.1 002VulnerableIBM
cpe:2.3:a:ibm:filenet_p8_application_engine:3.5.1:003:*:*:*:*:*:*3.5.1 003VulnerableIBM
cpe:2.3:a:ibm:filenet_p8_application_engine:3.5.1:004:*:*:*:*:*:*3.5.1 004VulnerableIBM
cpe:2.3:a:ibm:filenet_p8_application_engine:3.5.1:005:*:*:*:*:*:*3.5.1 005VulnerableIBM
cpe:2.3:a:ibm:filenet_p8_application_engine:3.5.1:006:*:*:*:*:*:*3.5.1 006VulnerableIBM
cpe:2.3:a:ibm:filenet_p8_application_engine:3.5.1:007:*:*:*:*:*:*3.5.1 007VulnerableIBM
cpe:2.3:a:ibm:filenet_p8_application_engine:3.5.1:008:*:*:*:*:*:*3.5.1 008VulnerableIBM
cpe:2.3:a:ibm:filenet_p8_application_engine:3.5.1:009:*:*:*:*:*:*3.5.1 009VulnerableIBM
  • cpe:2.3:a:ibm:filenet_p8_application_engine:3.5.1:*:*:*:*:*:*:* Versions 3.5.1 Vulnerable ·IBM
  • cpe:2.3:a:ibm:filenet_p8_application_engine:3.5.1:001:*:*:*:*:*:* Versions 3.5.1 001 Vulnerable ·IBM
  • cpe:2.3:a:ibm:filenet_p8_application_engine:3.5.1:002:*:*:*:*:*:* Versions 3.5.1 002 Vulnerable ·IBM
  • cpe:2.3:a:ibm:filenet_p8_application_engine:3.5.1:003:*:*:*:*:*:* Versions 3.5.1 003 Vulnerable ·IBM
  • cpe:2.3:a:ibm:filenet_p8_application_engine:3.5.1:004:*:*:*:*:*:* Versions 3.5.1 004 Vulnerable ·IBM
  • cpe:2.3:a:ibm:filenet_p8_application_engine:3.5.1:005:*:*:*:*:*:* Versions 3.5.1 005 Vulnerable ·IBM
  • cpe:2.3:a:ibm:filenet_p8_application_engine:3.5.1:006:*:*:*:*:*:* Versions 3.5.1 006 Vulnerable ·IBM
  • cpe:2.3:a:ibm:filenet_p8_application_engine:3.5.1:007:*:*:*:*:*:* Versions 3.5.1 007 Vulnerable ·IBM
  • cpe:2.3:a:ibm:filenet_p8_application_engine:3.5.1:008:*:*:*:*:*:* Versions 3.5.1 008 Vulnerable ·IBM
  • cpe:2.3:a:ibm:filenet_p8_application_engine:3.5.1:009:*:*:*:*:*:* Versions 3.5.1 009 Vulnerable ·IBM
Show 18 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:ibm:filenet_p8_application_engine:3.5.1:010:*:*:*:*:*:*3.5.1 010VulnerableIBM
cpe:2.3:a:ibm:filenet_p8_application_engine:3.5.1:011:*:*:*:*:*:*3.5.1 011VulnerableIBM
cpe:2.3:a:ibm:filenet_p8_application_engine:3.5.1:012:*:*:*:*:*:*3.5.1 012VulnerableIBM
cpe:2.3:a:ibm:filenet_p8_application_engine:3.5.1:013:*:*:*:*:*:*3.5.1 013VulnerableIBM
cpe:2.3:a:ibm:filenet_p8_application_engine:3.5.1:014:*:*:*:*:*:*3.5.1 014VulnerableIBM
cpe:2.3:a:ibm:filenet_p8_application_engine:3.5.1:015:*:*:*:*:*:*3.5.1 015VulnerableIBM
cpe:2.3:a:ibm:filenet_p8_application_engine:3.5.1:016:*:*:*:*:*:*3.5.1 016VulnerableIBM
cpe:2.3:a:ibm:filenet_p8_application_engine:3.5.1:017:*:*:*:*:*:*3.5.1 017VulnerableIBM
cpe:2.3:a:ibm:filenet_p8_application_engine:3.5.1:018:*:*:*:*:*:*3.5.1 018VulnerableIBM
cpe:2.3:a:ibm:filenet_p8_application_engine:3.5.1:019:*:*:*:*:*:*3.5.1 019VulnerableIBM
cpe:2.3:a:ibm:filenet_p8_application_engine:3.5.1:020:*:*:*:*:*:*3.5.1 020VulnerableIBM
cpe:2.3:a:ibm:filenet_p8_application_engine:4.0.2:*:*:*:*:*:*:*4.0.2VulnerableIBM
cpe:2.3:a:ibm:filenet_p8_application_engine:4.0.2:001:*:*:*:*:*:*4.0.2 001VulnerableIBM
cpe:2.3:a:ibm:filenet_p8_application_engine:4.0.2:002:*:*:*:*:*:*4.0.2 002VulnerableIBM
cpe:2.3:a:ibm:filenet_p8_application_engine:4.0.2:003:*:*:*:*:*:*4.0.2 003VulnerableIBM
cpe:2.3:a:ibm:filenet_p8_application_engine:4.0.2:004:*:*:*:*:*:*4.0.2 004VulnerableIBM
cpe:2.3:a:ibm:filenet_p8_application_engine:4.0.2:005:*:*:*:*:*:*4.0.2 005VulnerableIBM
cpe:2.3:a:ibm:filenet_p8_application_engine:4.0.2:006:*:*:*:*:*:*4.0.2 006VulnerableIBM
  • cpe:2.3:a:ibm:filenet_p8_application_engine:3.5.1:010:*:*:*:*:*:* Versions 3.5.1 010 Vulnerable ·IBM
  • cpe:2.3:a:ibm:filenet_p8_application_engine:3.5.1:011:*:*:*:*:*:* Versions 3.5.1 011 Vulnerable ·IBM
  • cpe:2.3:a:ibm:filenet_p8_application_engine:3.5.1:012:*:*:*:*:*:* Versions 3.5.1 012 Vulnerable ·IBM
  • cpe:2.3:a:ibm:filenet_p8_application_engine:3.5.1:013:*:*:*:*:*:* Versions 3.5.1 013 Vulnerable ·IBM
  • cpe:2.3:a:ibm:filenet_p8_application_engine:3.5.1:014:*:*:*:*:*:* Versions 3.5.1 014 Vulnerable ·IBM
  • cpe:2.3:a:ibm:filenet_p8_application_engine:3.5.1:015:*:*:*:*:*:* Versions 3.5.1 015 Vulnerable ·IBM
  • cpe:2.3:a:ibm:filenet_p8_application_engine:3.5.1:016:*:*:*:*:*:* Versions 3.5.1 016 Vulnerable ·IBM
  • cpe:2.3:a:ibm:filenet_p8_application_engine:3.5.1:017:*:*:*:*:*:* Versions 3.5.1 017 Vulnerable ·IBM
  • cpe:2.3:a:ibm:filenet_p8_application_engine:3.5.1:018:*:*:*:*:*:* Versions 3.5.1 018 Vulnerable ·IBM
  • cpe:2.3:a:ibm:filenet_p8_application_engine:3.5.1:019:*:*:*:*:*:* Versions 3.5.1 019 Vulnerable ·IBM
  • cpe:2.3:a:ibm:filenet_p8_application_engine:3.5.1:020:*:*:*:*:*:* Versions 3.5.1 020 Vulnerable ·IBM
  • cpe:2.3:a:ibm:filenet_p8_application_engine:4.0.2:*:*:*:*:*:*:* Versions 4.0.2 Vulnerable ·IBM
  • cpe:2.3:a:ibm:filenet_p8_application_engine:4.0.2:001:*:*:*:*:*:* Versions 4.0.2 001 Vulnerable ·IBM
  • cpe:2.3:a:ibm:filenet_p8_application_engine:4.0.2:002:*:*:*:*:*:* Versions 4.0.2 002 Vulnerable ·IBM
  • cpe:2.3:a:ibm:filenet_p8_application_engine:4.0.2:003:*:*:*:*:*:* Versions 4.0.2 003 Vulnerable ·IBM
  • cpe:2.3:a:ibm:filenet_p8_application_engine:4.0.2:004:*:*:*:*:*:* Versions 4.0.2 004 Vulnerable ·IBM
  • cpe:2.3:a:ibm:filenet_p8_application_engine:4.0.2:005:*:*:*:*:*:* Versions 4.0.2 005 Vulnerable ·IBM
  • cpe:2.3:a:ibm:filenet_p8_application_engine:4.0.2:006:*:*:*:*:*:* Versions 4.0.2 006 Vulnerable ·IBM

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2010-3470
  2. 2026-10-03 Alias added: GHSA-3gp9-pq9g-7grc

References

Advisory 2

Other 2

  • TI-2009-04758 The Workplace (aka WP) component in IBM FileNet P8 Application Engine (P8AE) 4.0.2.x… CVSS 2.0MEDIUM 6.4
  • TI-2010-03304 Open redirect vulnerability in the Workplace (aka WP) component in IBM FileNet P8… CVSS 2.0MEDIUM 5.8
  • TI-2010-03303 Multiple cross-site scripting (XSS) vulnerabilities in the Workplace (aka WP) component… CVSS 2.0MEDIUM 4.3
  • TI-2010-03302 Session fixation vulnerability in the Workplace (aka WP) component in IBM FileNet P8… CVSS 2.0MEDIUM 4.3
  • TI-2009-04756 Multiple cross-site scripting (XSS) vulnerabilities in the Workplace (aka WP) component… CVSS 2.0MEDIUM 4.3
  • TI-2009-04755 Cross-site scripting (XSS) vulnerability in the Workplace (aka WP) component in IBM… CVSS 2.0MEDIUM 4.3
See all 11 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences