Security Bulletin: IBM InfoSphere MDM Reference Data Management affected by Cross Site Scripting vulnerabilities(CVE-2015-1910)

Summary

IBM InfoSphere MDM Reference Data Management is vulnerable to Cross Site Scripting attack caused by improper validation of user-supplied input.

Vulnerability Details

CVEID:CVE-2015-1910**
DESCRIPTION: *IBM InfoSphere Master Data Management Server is vulnerable to cross-site scripting, caused by improper validation of user-supplied input. A remote attacker could exploit this vulnerability using a specially-crafted URL to execute script in a victim’s Web browser within the security context of the hosting Web site, once the URL is clicked. An attacker could use this vulnerability to steal the victim’s cookie-based authentication credentials.
CVSS Base Score: 3.5
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/101788 for the current score
CVSS Environmental Score: Undefined
CVSS Vector: (AV:N/AC:M/Au:S/C:N/I:P/A:N)

Affected Products and Versions

IBM InfoSphere MDM Reference Data Management Versions 11.3, 11.0, 10.1.

Remediation/Fixes

The recommended solution is to apply the fix as soon as practical. Please see below for information on the fixes available.

11.3

| None| 11.3-FP3
IBM InfoSphere MDM Reference Data Management|

11.0

| None| 11.0-FP3
IBM InfoSphere MDM Reference Data Management|

10.1

| None| 10.1-IF1

Workarounds and Mitigations

None known