Lucene search

K
ibmIBM8A2B4F419D835960A8C6162FEF83F38046C71BAE05724115DF0D52BF385F9A20
HistoryJan 12, 2023 - 9:59 p.m.

Security Bulletin: Speech to Text, Text to Speech ICP, WebSphere Application Server Liberty Fix

2023-01-1221:59:00
www.ibm.com
8

6.1 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

4.3 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

0.001 Low

EPSS

Percentile

28.0%

Summary

WebSphere Application Server Liberty vulnerability to Cross-site Scripting fixed in Liberty 20.0.0.5. Fix included in ICP Watson_Text_to_Speech and Speech to Text v1.1.2 (GA: 6/19/20).

Vulnerability Details

CVEID:CVE-2020-4303
**DESCRIPTION:**IBM WebSphere Application Server - Liberty 17.0.0.3 through 20.0.0.3 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 176668.
CVSS Base score: 6.1
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/176668 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)

CVEID:CVE-2020-4304
**DESCRIPTION:**IBM WebSphere Application Server - Liberty 17.0.0.3 through 20.0.0.3 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 176670.
CVSS Base score: 6.1
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/176670 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)

Affected Products and Versions

Affected Product(s) Version(s)
IBM Watson Speech to Text Customer Care 1.0.1-1.1

Remediation/Fixes

WebSphere Application Server Liberty vulnerability to Cross-site Scripting
Fixed in Liberty 20.0.0.5. Fix is included in ICP Watson_Text_to_Speech and Speech to Text v1.1.2 (GA: 6/19/20). Please download and install the latest version to receive this fix.

Workarounds and Mitigations

None

6.1 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

4.3 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

0.001 Low

EPSS

Percentile

28.0%

Related for 8A2B4F419D835960A8C6162FEF83F38046C71BAE05724115DF0D52BF385F9A20