Security Bulletin: IBM Cognos Command Center has addressed multiple vulnerabilities (Q12021)

Summary

There is a vulnerability in IBM® Runtime Environment Java™ Version 8 used by IBM Cognos Command Center. This issue was disclosed as part of the IBM Java SDK updates in October 2020. IBM Command Center 10.2.4 FP1 IF14 has addressed the applicable CVE. Additionally , a vulnerability in jQuery has been addressed.

Vulnerability Details

CVEID:CVE-2020-14797
**DESCRIPTION:**An unspecified vulnerability in Java SE related to the Libraries component could allow an unauthenticated attacker to cause no confidentiality impact, low integrity impact, and no availability impact.
CVSS Base score: 3.7
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/190115 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N)

CVEID:CVE-2019-11358
**DESCRIPTION:**jQuery, as used in Drupal core, is vulnerable to cross-site scripting, caused by improper validation of user-supplied input. A remote authenticated attacker could exploit this vulnerability to execute script in a victim’s Web browser within the security context of the hosting Web site. An attacker could use this vulnerability to steal the victim’s cookie-based authentication credentials.
CVSS Base score: 6.1
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/159633 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)

Affected Products and Versions

IBM Cognos Command Center 10.2.4.1

IBM Cognos Command Center 10.2.4.0

Remediation/Fixes

Cognos Command Center 10.2.4 Fix Pack 1 IF14

Workarounds and Mitigations

None