IBMCEB402797388C3B3870BAED4DAB54CB61452DF33FFDA2DB5A814A5221E0FC0B4Security Bulletin: IBM Ingelligent Operations Center is Vulnerable to Stored Cross-Site Scripting (CVE-2020-4318)
0.001 Low
EPSS
Percentile
19.9%
Summary
IBM Ingelligent Operations Center is Vulnerable to Stored Cross-Site Scripting
Vulnerability Details
CVEID:CVE-2020-4318
**DESCRIPTION:**IBM Intelligent Operations Center for Emergency Management, Intelligent Operations Center (IOC) is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.
CVSS Base score: 5.4
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/177356 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N)
Affected Products and Versions
| Affected Product(s) | Version(s) |
|---|---|
| Intelligent Operations Center (IOC) | 5.1.0, 5.1.0.2, 5.1.0.3, 5.1.0.4, 5.1.0.6, 5.2, 5.2.1 |
| IBM Water Operations for Waternamics (Linux) | 5.1.0, 5.1.0.2, 5.1.0.3, 5.1.0.4, 5.1.0.6, 5.2, 5.2.1 |
| IBM Intelligent Operations Center for Emergency Management (Linux) | 5.1.0, 5.1.0.2, 5.1.0.3, 5.1.0.4, 5.1.0.6 |
Remediation/Fixes
The recommended solution is to apply an interim fix that contains the fix for this issue as soon as practical.
Download the IBM Intelligent Operations Center Version 5.2.1.1 is an upgrade to IBM Intelligent Operations Center Version 5.1 through IBM Intelligent Operations Center Version 5.2 from the following link: IBM Intelligent Operations Center Version 5.2.1.1. Installation instructions for the fix are included in the readme document that is in the fix package.
Workarounds and Mitigations
None
Related
0.001 Low
EPSS
Percentile
19.9%