There is a vulnerability in Jinja that could allow an attacker to steal cookie-based authentication credentials on the system. The code is used by IBM Process Mining. This bulletin identifies the security fixes to apply to address the vulnerability.
CVEID:CVE-2024-22195
**DESCRIPTION:**Pallets Jinja is vulnerable to cross-site scripting, caused by improper validation of user-supplied input by the xmlattr filter. A remote authenticated attacker could exploit this vulnerability to inject malicious script into a Web page which would be executed in a victim’s Web browser within the security context of the hosting Web site, once the page is viewed. An attacker could use this vulnerability to steal the victim’s cookie-based authentication credentials.
CVSS Base score: 5.4
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/279344 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N)
Affected Product(s) | Version(s) |
---|---|
IBM Process Mining |
1.14.0, 1.14.1, 1.14.2, 1.14.2 IF001, 1.14.3, 1.14.3 IF001
Any open source library may be included in one or more sub-components of IBM Process Mining. Open source updates are not always synchronized across all components. The CVE in this bulletin are specifically addressed by
Product(s) | **Version(s) number and/or range ** | Remediation/Fix/Instructions |
---|---|---|
IBM Process Mining on RedHat OpenShift |
1.14.0, 1.14.1, 1.14.2, 1.14.2 IF001, 1.14.3, 1.14.3 IF001
| **Install/Upgrade to version 1.14.4
Installing a Production deployment
1.**To deploy a Production deployment, see installing on
RedHat OpenShift Container Platform environments
**Upgrading an Installation **** **1.To perform an upgrade of a Production deployment, see
upgrading in RedHat OpenShift Container Platform
environments
IBM Process Mining traditional|
1.14.0, 1.14.1, 1.14.2, 1.14.3
| **Install/Upgrade to version 1.14.4
** 1.Login to PassPortAdvantage
2.Search for
M0HJMML Process Mining 1.14.4 Server Multiplatform
Multilingual
3.Download package
4.Follow install instructions
5.Repeat for M0HJNML Process Mining 1.14.4 Client
Windows Multilingual
None known