Security Bulletin: Vulnerability in sanitize-url affects IBM Process Mining . CVE-2022-48345

Summary

There is a vulnerability in sanitize-url that could allow a remote attacker to execute script in a victim’s Web browser due to cross-site scripting. The code is used by IBM Process Mining. This bulletin identifies the security fixes to apply to address the vulnerability.

Vulnerability Details

CVEID:CVE-2022-48345
**DESCRIPTION:**sanitize-url is vulnerable to cross-site scripting, caused by improper validation of user-supplied input. A remote attacker could exploit this vulnerability to execute script in a victim’s Web browser within the security context of the hosting Web site. An attacker could use this vulnerability to steal the victim’s cookie-based authentication credentials.
CVSS Base score: 6.1
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/248548 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)

Affected Products and Versions

Remediation/Fixes

Remediation/Fixes guidance:

Upgrade to version 1.14.0.0

1.Login to PassPortAdvantage

2. Search for
M0BMPML Process Mining 1.14.0.0 Server Multiplatform Multilingual

3. Download package

4. Follow install instructions

5. Repeat for M0BMQML Process Mining 1.14.0.0 Client Windows Multilingual

| |

Workarounds and Mitigations

Workarounds/Mitigation guidance:

None known