Security Bulletin: Cross-Site Request Forgery (CSRF) vulnerability identified with Jazz for Service Management (JazzSM) v1.1.3 (CVE-2017-1631)

Summary

Change password functionality is not protected against cross-site request forgery, also JazzSM does not require user to know current password.

Vulnerability Details

CVEID: CVE-2017-1631**
DESCRIPTION:** IBM Jazz for Service Management is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts.
CVSS Base Score: 4.3
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/133140 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N)

Affected Products and Versions

Jazz for Service Management version 1.1.3

Remediation/Fixes

Principal Product and Version(s)

| Cumulative Patch Level
—|—
Jazz for Service Management version 1.1.3| Cross-Site Request Forgery (CSRF) vulnerability addressed with JazzSM 1.1.3 Cumulative Patch level 5
1.1.3.0-TIV-JazzSM-DASH-Cumulative-Patch-0005

Workarounds and Mitigations

None