IT48538: IBM STORAGE INSIGHTS SECURITY APAR FOR BACK AND REFRESH ATTACK

APAR status

• Closed as program error.

Error description

• Browsers have the ability to maintain a recent record of pages
  that were visited by a user. The Back and Forward buttons on
  browsers use this functionality to display the pages recently
  browsed. In addition, browsers also keep track of variables like
  username, password, credit card details, etc. that were posted
  to the server while fetching the page. If a user logs in to the
  website, performs some actions and then logs out, and an
  adversary has access to the same machine as the user, he can see
  the logout page that is displayed on the browser window. He can
  then click the Back button until he reaches the page shown after
  a successful login. Here, the attacker can click the Refresh
  button, and the browser automatically resubmits the request with
  all the information, which can be stolen by the attacker, by
  simply intercepting the request.
  

Local fix

Problem summary

• ****************************************************************
  * USERS AFFECTED:                                              *
  * IBM Storage Insights users                                   *
  *                                                              *
  ****************************************************************
  * PROBLEM DESCRIPTION:                                         *
  * SECURITY APAR FOR                                            *
  * BACK AND REFRESH ATTACK                                      *
  ****************************************************************
  * RECOMMENDATION:                                              *
  ****************************************************************
  

Problem conclusion

• The fix for this APAR is contained in the following release:
  
  IBM Storage Insights 3Q25   [ 54X-IBM-SI ]
  ( contained in 3Q 2025 / September )
  
  To protect IBM Storage Insights against emerging
  security vulnerabilities, the service was updated to
  protected against vulnerabilities.
  
  No action is required, there is nothing that you need
  to do following the IBM Storage Insights upgrade.
  

Temporary fix

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

Fix information

• Fixed component name

  STORAGE INSIGHT

• Fixed component ID

  5608TPCSI

Applicable component levels