Security Bulletin: IBM Security Access Manager Appliance has fixed a cross site scripting vulnerability (CVE-2018-1740)

Summary

The IBM Security Access Manager Appliance has fixed a cross site scripting vulnerability.

Vulnerability Details

CVEID: CVE-2018-1740 DESCRIPTION: IBM Security Access Manager Appliance is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.
CVSS Base Score: 5.4
CVSS Temporal Score: See <https://exchange.xforce.ibmcloud.com/vulnerabilities/148419&gt; for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N)

Affected Products and Versions

Affected IBM Security Access Manager Appliance

|

Affected Versions

—|—
IBM Security Access Manager for Web | 8.0 - 8.0.1.8
IBM Security Access Manager for Mobile | 8.0 - 8.0.1.8
IBM Security Access Manager | 9.0 - 9.0.5.0

Remediation/Fixes

1. For versions prior to 8.0.1.8, upgrade to 8.0.1.8:

8.0.1-ISS-WGA-FP0008

2. Upgrade to 8.0.1.8.IF1

8.0.1.8-ISS-WGA-IF0001

IBM Security Access Manager for Mobile | 8.0.0.0 - 8.0.1.8 | |

1. For versions prior to 8.0.1.8, upgrade to 8.0.1.8

8.0.1-ISS-ISAM-FP0008

2. Upgrade to 8.0.1.8 IF0001

8.0.1.8-ISS-ISAM-IF0001

ISAM | 9.0 - 9.0.5.0 | IJ11991 |

For versions prior to 9.0.6.0, upgrade to 9.0.6.0:

9.0.6-ISS-ISAM-FP0000