PM38059: SECURITY ALERT FOR REFLECTED CROSS SITE SCRIPTING

APAR status

• Closed as program error.

Error description

• XSS attacks may be used to present content to a user with the
  intention of redirecting the user to a malicious website. XSS
  attacks may also be used to steal a user s session details
  giving an attacker the ability to  hijack  the user s session.
  The tar-geted user must be authenticated when accessing the URL.
  

Local fix

Problem summary

• ****************************************************************
  * USERS AFFECTED:                                              *
  ****************************************************************
  * PROBLEM DESCRIPTION:                                         *
  ****************************************************************
  * RECOMMENDATION:                                              *
  ****************************************************************
  XSS attacks may be used to present content to a user with
  the intention of redirecting the user to a malicious
  website. XSS attacks may also be used to steal a user s
  session details giving an attacker the ability to  hijack
  the user s session. The tar-geted user must be authenticated
  when accessing the URL.
  

Problem conclusion

• This is fixed in 7.1.3.
  

Temporary fix

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

Fix information

• Fixed component name

  BUILD FORGE EE

• Fixed component ID

  5724S2701

Applicable component levels

• R712 PSN

     UP