PM26682: CLIENT: A security scan reveals cross site script vulnerability in Executive Viewer

APAR status

• Closed as program error.

Error description

• ??Customer used IBM Rational AppScan tool to scan their EV
  environment.  This is a new / fresh / first time installation of
  the Executive Viewer.  As part of their security policy they ran
  Application vulnerability Assessment against the URL provided by
  Yelu.  Again, this is the first scan of this
  machine/environment.  ??
                                        ??The AppScan results
  indicate two high vulnerabilities (Cross Site Scripting) for the
  /aspnet_client and /evserver/createcontrol.js.  ??
  
  ??????
  

Local fix

• N.A.
  

Problem summary

• ****************************************************************
  * USERS AFFECTED:                                              *
  * Executive Viewer Client users                                *
  ****************************************************************
  * PROBLEM DESCRIPTION:                                         *
  * See error description.                                       *
  ****************************************************************
  * RECOMMENDATION:                                              *
  * Upgrade to IBM Cognos Executive Viewer 9.5 Fix Pack 1        *
  ****************************************************************
  

Problem conclusion

• Code Fix
  

Temporary fix

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

Fix information

• Fixed component name

  TM1 EXE VIEW SE

• Fixed component ID

  5724W49ES

Applicable component levels

• R950 PSN

     UP