Security Bulletin: IBM InfoSphere Information Server is affected by an unescaped string injection in Dojo Toolkit

Summary

An unescaped string injection vulnerability in Dojo Toolkit that is used by IBM InfoSphere Information Server was addressed.

Vulnerability Details

CVEID: CVE-2018-15494 DESCRIPTION: Dojo Toolkit is vulnerable to cross-site scripting, caused by improper validation of user-supplied input by the DataGrid component. A remote attacker could exploit this vulnerability to inject malicious script into a Web page which would be executed in a victim’s Web browser within the security context of the hosting Web site, once the page is viewed. An attacker could use this vulnerability to steal the victim’s cookie-based authentication credentials. CVSS Base Score: 6.1
CVSS Temporal Score: See _<https://exchange.xforce.ibmcloud.com/vulnerabilities/148556&gt;_ for more information
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)

Affected Products and Versions

The following product, running on all supported platforms, is affected:
IBM InfoSphere Information Server : versions 11.3, 11.5, 11.7
IBM InfoSphere Information Server on Cloud : versions 11.5, 11.7

Remediation/Fixes

Product

| VRMF | APAR | Remediation/First Fix
—|—|—|—
InfoSphere Information Server, Information Server on Cloud | 11.7 | JR61706 | --Apply InfoSphere Information Server version 11.7.1.0
--Apply InfoSphere Information Server 11.7.1.0 Fix Pack 1
--For InfoSphere DataStage
11.7.1.0 11.7.1.1 & 11.7.1.2: Apply InfoSphere DataStage Security patch
InfoSphere Information Server, Information Server on Cloud | 11.5 | JR61706 | --Apply InfoSphere Information Server version 11.5.0.2
--Apply InfoSphere Information Server 11.5.0.2 Service Pack 6
--Apply InfoSphere Information Server Framework Security patch --Apply InfoSphere Metadata Asset Manager Security patch--Apply InfoSphere DataStage Security patch

InfoSphere Information Server | 11.3 | JR61706 | --Upgrade to a new release where the issue has been addressed

Contact Technical Support:

In the United States and Canada dial 1-800-IBM-SERV
View the support contacts for other countries outside of the United States.
Electronically open a Service Request with Information Server Technical Support.

Workarounds and Mitigations

None