Security Bulletin: IBM Cloud Automation Manager is affected by a insecure Content-Security-Policy header vulnerability CVE-2019-4133

Summary

IBM Cloud Automation Manager could allow a malicious user on the client side (with access to client computer) to run a custom script.

Vulnerability Details

CVEID:CVE-2019-4133
DESCRIPTION: IBM Cloud Automation Manager could allow a malicious user on the client side (with access to client computer) to run a custom script.
CVSS Base Score: 5
CVSS Temporal Score: See <https://exchange.xforce.ibmcloud.com/vulnerabilities/158278&gt; for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:L)

Affected Products and Versions

IBM Cloud Automation Manager 3.1.2

Remediation/Fixes

IBM Cloud Automation Manager users should upgrade to one of the following releases:

IBM Cloud Automation Manager 3.1.2.2

or

IBM Cloud Automation Manager 3.2.0

(Install instructions are identical for both releases):

https://www.ibm.com/support/knowledgecenter/en/SS2L37_3.2.0.0/cam_upgrade_cam.html

Workarounds and Mitigations

None.