Security Bulletin: A Cross Site Scripting vulnerability was fixed in the IBM Security Verify Access Product.

Summary

The IBM Security Verify Access product has fixed a cross-site scripting vulnerability which would allow users to embed arbirtrary JavaScript code in the Web UI.

Vulnerability Details

CVEID:CVE-2022-22370
**DESCRIPTION:**IBM Security Verify Access is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.
CVSS Base score: 5.4
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/221194 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N)

Affected Products and Versions

Remediation/Fixes

For the ISAM/ISVA appliances

Affected Products and Versions

|

Fix availability

—|—

IBM Security Verify Access 10.0.0.0

|

10.0.4-ISS-ISVA-FP0000

IBM Security Verify Access (Container)

For Version 10.0.0.0

• Obtain the latest version of the container by running the following command “docker pull ibmcom/verify-access:[tag]”

Where [tag] is the latest published version and can be confirmed here

Workarounds and Mitigations

None