Security Bulletin: BigInsights is affected by multiple vulnerabilities in BigSheets and Data Server Manager (CVE-2017-1552, CVE-2017-1553, CVE-2017-1554)

Summary

BigInsights is affected by multiple UI vulnerabilities in BigSheets and Data Server Manager (DSM)

Vulnerability Details

CVEID: CVE-2017-1552**
DESCRIPTION:** IBM Infosphere BigInsights is vulnerable to link injection. By persuading a victim to click on a specially-crafted URL link, a remote attacker could exploit this vulnerability to conduct various attacks against the vulnerable system, including cross-site scripting, cache poisoning or session hijacking.
CVSS Base Score: 5.4
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/131396 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N)

CVEID: CVE-2017-1553**
DESCRIPTION:** IBM Infosphere BigInsights is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.
CVSS Base Score: 5.4
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/131397 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N)

CVEID: CVE-2017-1554**
DESCRIPTION:** IBM Infosphere BigInsights could allow a remote attacker to hijack the clicking action of the victim. By persuading a victim to visit a malicious Web site, a remote attacker could exploit this vulnerability to hijack the victim’s click actions and possibly launch further attacks against the victim.
CVSS Base Score: 5.4
CVSS Temporal Score: See _https://exchange.xforce.ibmcloud.com/vulnerabilities/131398 _for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N)

Affected Products and Versions

BigInsights 4.2, 4.2.5

Remediation/Fixes

Please contact technical support to obtain fix and install instructions.