Lucene search

K
ibmIBMC69BE5F5090034703E7D6368F8DE6EC3D04E7111D57F7E4490997DE6A76E3966
HistoryJun 17, 2018 - 12:11 p.m.

Security Bulletin: Multiple cross-site scripting (XSS) vulnerabilities in IBM Dojo Toolkit affects IBM Case Manager (CVE-2014-8917)

2018-06-1712:11:00
www.ibm.com
7

4.3 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

0.004 Low

EPSS

Percentile

73.4%

Summary

There are multiple cross-site scripting (XSS) vulnerabilities in (1) uploader.swf, (2) fileuploader.swf, (3) audio.swf, and (4) video.swf in the IBM Dojo Toolkit.

Vulnerability Details

CVE-ID: CVE-2014-8917

Description: There are multiple cross-site scripting (XSS) vulnerabilities in the following IBM Dojo Toolkit files:
(1) dojox/form/resources/uploader.swf (upload.swf)
(2) dojox/form/resources/fileuploader.swf (fileupload.swf)
(3) dojox/av/resources/audio.swf
(4) dojox/av/resources/video.swf

These files, as used in IBM Social Media Analytics 1.3 before IF11 and other products, allow remote attackers to inject arbitrary web script or HTML by using unspecified vectors.

CVSS Base Score: 4.3
CVSS Temporal Score: See <https://exchange.xforce.ibmcloud.com/vulnerabilities/99303&gt; for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:M/Au:N/C:N/I:P/A:N)

Affected Products and Versions

IBM Case Manager 5.1.1 - Fix Pack 2 or prior
IBM Case Manager 5.2.0 - Fix Pack 2 or prior
IBM Case Manager 5.2.1 - Fix Pack 1 or prior

Remediation/Fixes

Product

|

VRMF

|

APAR

|

Remediation/First Fix

โ€”|โ€”|โ€”|โ€”
IBM Case Manager| 5.1.1.3| N/A| 5.1.1.3-ICM-FP003_ or later versions_
IBM Case Manager| 5.2.0.2-IF001| N/A| 5.2.0.2-ICM-IF001_ or later versions_
IBM Case Manager| 5.2.1.2| N/A| 5.2.1.2-ICM-FP002_ or later versions_

IBM recommends that you review your entire environment to identify areas that uses the Dojo files that are listed in the Description section and take appropriate mitigation and remediation actions. The most immediate mitigation action that you can take is to remove these four Dojo files. Verify that removing these four Dojo files does not cause any issues, including compatibility issues.

4.3 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

0.004 Low

EPSS

Percentile

73.4%

Related for C69BE5F5090034703E7D6368F8DE6EC3D04E7111D57F7E4490997DE6A76E3966