IBM8FCCAF502B1DEFDC1D049AA4F0E6799049FBA0CBA1ADF686AF46786DCE26BDACSecurity Bulletin: Cross Site Scripting (XSS) CVE-2023-35905 security vulnerability in FileNet Content Manager FileNet DetailedStatus
5.4 Medium
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
REQUIRED
Scope
CHANGED
Confidentiality Impact
LOW
Integrity Impact
LOW
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
0.0004 Low
EPSS
Percentile
13.2%
Summary
Cross Site Scripting (XSS) CVE-2023-35905 security vulnerability in FileNet Content Manager FileNet DetailedStatus parameter name
Vulnerability Details
CVEID:CVE-2023-35905
**DESCRIPTION:**IBM FileNet Content Manager is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.
CVSS Base score: 4.6
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/259384 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N)
Affected Products and Versions
| Affected Product(s) | Version(s) |
|---|---|
| FileNet Content Manager 5.5.10 | 5.5.8.0 |
| FileNet Content Manager | 5.5.10.0 |
| FileNet Content Manager | 5.5.11.0 |
Remediation/Fixes
To resolve these vulnerabilities, install one of the patch sets listed below.
| Product | VRMF | APAR | Remediation/First Fix |
|---|---|---|---|
| FileNet Content Manager | 5.5.8.0 | PJ47094 | 5.5.8.0-P8CPE-IF005 - 8/30/2023 |
| FileNet Content Manager | 5.5.10.0 | PJ47094 | 5.5.10.0-P8CPE-IF002 - 7/28/2023 |
| FileNet Content Manager | 5.5.11.0 | PJ47094 | 5.5.11.0-P8CPE-IF001 - 9/27/2023 |
In the above table, the APAR links will provide more information about the fix.
Workarounds and Mitigations
None
Affected configurations
| CPE | Name | Operator | Version |
|---|---|---|---|
| filenet content manager | eq | 5.5.8 | |
| filenet content manager | eq | 5.5.10 | |
| filenet content manager | eq | 5.5.11 |
Related
5.4 Medium
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
REQUIRED
Scope
CHANGED
Confidentiality Impact
LOW
Integrity Impact
LOW
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
0.0004 Low
EPSS
Percentile
13.2%