Security Bulletin: Multiple cross-site scripting (XSS) vulnerabilities in IBM Dojo Toolkit affects IBM Case Manager (CVE-2014-8917)

Summary

There are multiple cross-site scripting (XSS) vulnerabilities in (1) uploader.swf, (2) fileuploader.swf, (3) audio.swf, and (4) video.swf in the IBM Dojo Toolkit.

Vulnerability Details

CVE-ID: CVE-2014-8917

Description: There are multiple cross-site scripting (XSS) vulnerabilities in the following IBM Dojo Toolkit files:
(1) dojox/form/resources/uploader.swf (upload.swf)
(2) dojox/form/resources/fileuploader.swf (fileupload.swf)
(3) dojox/av/resources/audio.swf
(4) dojox/av/resources/video.swf

These files, as used in IBM Social Media Analytics 1.3 before IF11 and other products, allow remote attackers to inject arbitrary web script or HTML by using unspecified vectors.

CVSS Base Score: 4.3
CVSS Temporal Score: See <https://exchange.xforce.ibmcloud.com/vulnerabilities/99303&gt; for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:M/Au:N/C:N/I:P/A:N)

Affected Products and Versions

IBM Case Manager 5.1.1 - Fix Pack 2 or prior
IBM Case Manager 5.2.0 - Fix Pack 2 or prior
IBM Case Manager 5.2.1 - Fix Pack 1 or prior

Remediation/Fixes

Product

|

VRMF

|

APAR

|

Remediation/First Fix

—|—|—|—
IBM Case Manager| 5.1.1.3| N/A| 5.1.1.3-ICM-FP003_ or later versions_
IBM Case Manager| 5.2.0.2-IF001| N/A| 5.2.0.2-ICM-IF001_ or later versions_
IBM Case Manager| 5.2.1.2| N/A| 5.2.1.2-ICM-FP002_ or later versions_

IBM recommends that you review your entire environment to identify areas that uses the Dojo files that are listed in the Description section and take appropriate mitigation and remediation actions. The most immediate mitigation action that you can take is to remove these four Dojo files. Verify that removing these four Dojo files does not cause any issues, including compatibility issues.