Security Bulletin: A cross-site scripting (XSS) vulnerability may impact IBM Cúram Social Program Management(CVE-2021-39068)

Summary

A cross-site scripting (XSS) vulnerability may impact IBM Cúram Social Program Management. This vulnerability allows attackers to inject malicious scripts into web applications for the purpose of running unwanted actions on the end user’s device, restricted to a single location.

Vulnerability Details

CVEID:CVE-2021-39068
**DESCRIPTION:**IBM Curam Social Program Management is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.
CVSS Base score: 5.4
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/215306 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N)

Affected Products and Versions

Remediation/Fixes

8.0.1

| Visit IBM Fix Central and upgrade to 8.0.1_iFix3 or a subsequent 8.0.1 release.
Cúram SPM|

7.0.11

| Visit IBM Fix Central and upgrade to 7.0.11_iFix7 or a subsequent 7.0.11 release.

Workarounds and Mitigations

None