Lucene search

K
ibmIBMBA32813A44F3974E52DA76A1B0B825D83AE8F6C7A44F8FE8D8F4C0CCB06F2AA1
HistorySep 27, 2019 - 6:05 p.m.

Security Bulletin: Multiple security vulnerabilities affect the Report Builder that is shipped with Jazz Reporting Service (CVE-2019-4494, CVE-2019-4495, CVE-2019-4497)

2019-09-2718:05:57
www.ibm.com
6

EPSS

0.001

Percentile

19.6%

Summary

There are multiple security vulnerabilities in the Report Builder shipped with Jazz Reporting Service.

Vulnerability Details

CVEID: CVE-2019-4494 DESCRIPTION: IBM Jazz Reporting Service (JRS) is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.
CVSS Base Score: 5.4
CVSS Temporal Score: See <https://exchange.xforce.ibmcloud.com/vulnerabilities/164115&gt; for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N)

CVEID: CVE-2019-4495 DESCRIPTION: IBM Jazz Reporting Service (JRS) is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.
CVSS Base Score: 5.4
CVSS Temporal Score: See <https://exchange.xforce.ibmcloud.com/vulnerabilities/164116&gt; for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N)

CVEID: CVE-2019-4497 DESCRIPTION: IBM Jazz Reporting Service (JRS) is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.
CVSS Base Score: 5.4
CVSS Temporal Score: See <https://exchange.xforce.ibmcloud.com/vulnerabilities/164118&gt; for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N)

Affected Products and Versions

Jazz Reporting Service 6.0, 6.0.1, 6.0.2, 6.0.3, 6.0.4, 6.0.5, 6.0.6 and 6.0.6.1.

Remediation/Fixes

Apply the recommended fixes to all affected versions of Jazz Reporting Service.

Product VRMF Remediation
Jazz Reporting Service 6.0, 6.0.1, 6.0.2 Download the interim fix 6.0.2-Rational-CLM-ifix022 (or later) package from the 6.0.2 iFix release site and follow the instructions inside the package for patch application.
Jazz Reporting Service 6.0.3, 6.0.4, 6.0.5, 6.0.6 Download the interim fix 6.0.6-Rational-CLM-ifix011 (or later) package from the 6.0.6 iFix release site and follow the instructions inside the package for patch application.
Jazz Reporting Service 6.0.6.1 Download the interim fix 6.0.6.1-Rational-CLM-ifix004 (or later) package from the 6.0.6.1 iFix release site and follow the instructions inside the package for patch application.

For any prior versions of the products listed above, IBM recommends upgrading to a fixed, supported version/release/platform of the product.

If the iFix is not found in the iFix Portal please contact IBM support.

Workarounds and Mitigations

None

EPSS

0.001

Percentile

19.6%

Related for BA32813A44F3974E52DA76A1B0B825D83AE8F6C7A44F8FE8D8F4C0CCB06F2AA1