Lucene search

IBM19EF95487209475A4C7C52E2FB72FDF5EF8D0AC8C67C26EE8D2B46B8E299B89D

HistoryJul 01, 2024 - 3:57 p.m.

Security Bulletin: IBM WebSphere Application Server shipped with Jazz for Service Management (JazzSM) is vulnerable to cross-site scripting (CVE-2024-35153)

2024-07-0115:57:06

www.ibm.com

ibm websphere

jazzsm

cross-site scripting

vulnerability

upgrade

interim fix

4.8 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

0.0004 Low

EPSS

Percentile

9.2%

JSON

Summary

IBM WebSphere Application Server shipped with Jazz for Service Management (JazzSM) is vulnerable to cross-site scripting in the administrative console.

Vulnerability Details

Refer to the security bulletin(s) listed in the Remediation/Fixes section

Affected Products and Versions

Affected Product(s)	Version(s)
Jazz for Service Management	1.1.3

Remediation/Fixes

IBM strongly recommends addressing the vulnerability now by upgrading Websphere Application Server

Principal Product and Version(s)	Affected Supporting Product and Version	Affected Supporting Product Security Bulletin
Jazz for Service Management version 1.1.3 - 1.1.3.21

Websphere Application Server Full Profile 8.5.5

| Security Bulletin: IBM WebSphere Application Server is vulnerable to cross-site scripting (CVE-2024-35153)
Jazz for Service Management version 1.1.3.7 - 1.1.3.21|

Websphere Application Server Full Profile 9.0

| Security Bulletin: IBM WebSphere Application Server is vulnerable to cross-site scripting (CVE-2024-35153)

Workarounds and Mitigations

Please refer to WAS interim fix.

Affected configurations

Vulners

Node

ibmjazz_for_service_managementMatch1.1.3

CPENameOperatorVersion
jazz for service managementeq1.1.3

CPE	Name	Operator	Version
	jazz for service management	eq	1.1.3