IBM Security Guardium has addressed the following vulnerabilities.
CVEID: CVE-2018-1889 DESCRIPTION: IBM Security Guardium is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.
CVSS Base Score: 5.4
CVSS Temporal Score: See <https://exchange.xforce.ibmcloud.com/vulnerabilities/152080> for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N)
Affected IBM Security Guardium
|
Affected Versions
—|—
IBM Security Guardium | 10.0 - 10.5
Product
|
VRMF
|
Remediation / First Fix
—|—|—
IBM Security Guardium | 10.0 - 10.5 |
Customers can upgrade to version 10.6 by downloading from here:
http://www.ibm.com/support/fixcentral/swg/quickorder?parent=IBM Security&product=ibm/Information+Management/InfoSphere+Guardium&release=10.0&platform=All&function=fixId&fixids=SqlGuard_10.0p600_GPU_Nov-2018-V10.6&includeSupersedes=0&source=fc
Or
Customers currently on version 10.5 with patch 10.0p512 installed can upgrade version 10.5 with bundle 10.0p520 from here:
http://www.ibm.com/support/fixcentral/swg/quickorder?parent=IBM Security&product=ibm/Information+Management/InfoSphere+Guardium&release=10.0&platform=All&function=fixId&fixids=SqlGuard_10.0p520_Bundle_Dec-06-2018&includeSupersedes=0&source=fc
None