An unescaped string injection vulnerability in Dojo Toolkit that is used by IBM InfoSphere Information Server was addressed.
CVEID: CVE-2018-15494 DESCRIPTION: Dojo Toolkit is vulnerable to cross-site scripting, caused by improper validation of user-supplied input by the DataGrid component. A remote attacker could exploit this vulnerability to inject malicious script into a Web page which would be executed in a victimβs Web browser within the security context of the hosting Web site, once the page is viewed. An attacker could use this vulnerability to steal the victimβs cookie-based authentication credentials. CVSS Base Score: 6.1
CVSS Temporal Score: See _<https://exchange.xforce.ibmcloud.com/vulnerabilities/148556>_ for more information
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
The following product, running on all supported platforms, is affected:
IBM InfoSphere Information Server : versions 11.3, 11.5, 11.7
IBM InfoSphere Information Server on Cloud : versions 11.5, 11.7
Product
| VRMF | APAR | Remediation/First Fix
β|β|β|β
InfoSphere Information Server, Information Server on Cloud | 11.7 | JR61706 | --Apply InfoSphere Information Server version 11.7.1.0
--Apply InfoSphere Information Server 11.7.1.0 Fix Pack 1
--For InfoSphere DataStage
11.7.1.0 11.7.1.1 & 11.7.1.2: Apply InfoSphere DataStage Security patch
InfoSphere Information Server, Information Server on Cloud | 11.5 | JR61706 | --Apply InfoSphere Information Server version 11.5.0.2
--Apply InfoSphere Information Server 11.5.0.2 Service Pack 6
--Apply InfoSphere Information Server Framework Security patch --Apply InfoSphere Metadata Asset Manager Security patch--Apply InfoSphere DataStage Security patch
InfoSphere Information Server | 11.3 | JR61706 | --Upgrade to a new release where the issue has been addressed
Contact Technical Support:
In the United States and Canada dial 1-800-IBM-SERV
View the support contacts for other countries outside of the United States.
Electronically open a Service Request with Information Server Technical Support.
None