APAR status
Closed as program error.
Error description
It is possible to embed Process Portal in an iFrame, allowing cross-frame scripting attacks (attacks can redirect user to an iFrame containing Process Portal).
Local fix
n/a
Problem summary
**************************************************************** * USERS AFFECTED: Users of BPM Advanced, BPM Standard, and * * BPM Express. * **************************************************************** * PROBLEM DESCRIPTION: It is possible to embed Process * * Portal in an iFrame, allowing * * cross-frame scripting attacks * * (attacks can redirect user to an * * iFrame containing Process Portal). * **************************************************************** * RECOMMENDATION: * **************************************************************** Process Portal did not detect attempts to embed Process Portal in an iFrame, allowing cross-frame scripting attacks.
Problem conclusion
Code has been added to detect and block attempts to embed Process Portal in an iFrame. This detection code is enabled by default, and must be disabled via a new configuration parameter, <enable-run-in-frame>, in 100Custom.xml. An interim fix for Business Process Manager Version 7.5.1.1 has been published to Fix Central. Please refer to the separate file that is automatically downloaded with the interim fix for prerequisite information and installation/uninstallation instructions. Note that this interim fix also includes the fix for APAR JR49002 (http://www.ibm.com/support/docview.wss?uid=swg1JR49002).
Temporary fix
Comments
APAR Information
APAR number
JR48971
Reported component name
BPM ADVANCED
Reported component ID
5725C9400
Reported release
751
Status
CLOSED PER
PE
NoPE
HIPER
NoHIPER
Special Attention
NoSpecatt
Submitted date
2014-01-07
Closed date
2014-02-28
Last modified date
2014-02-28
APAR is sysrouted FROM one or more of the following:
APAR is sysrouted TO one or more of the following:
Fix information
Fixed component name
BPM ADVANCED
Fixed component ID
5725C9400
Applicable component levels
R750 PSY
UP
[{"Business Unit":{"code":"BU053","label":"Cloud & Data Platform"},"Product":{"code":"SSFTN5","label":"IBM Business Process Manager Advanced"},"Platform":[{"code":"PF025","label":"Platform Independent"}],"Version":"7.5.1","Line of Business":{"code":"LOB45","label":"Automation"}}]
Document Information
Modified date:
11 October 2021