IBM Support

Security Bulletin: Multiple cross-site scripting (XSS) vulnerabilities in IBM Dojo Toolkit affects IBM Case Manager (CVE-2014-8917)

Created by Sadiq Bakshi on

Security Bulletin


Summary

There are multiple cross-site scripting (XSS) vulnerabilities in (1) uploader.swf, (2) fileuploader.swf, (3) audio.swf, and (4) video.swf in the IBM Dojo Toolkit.

Vulnerability Details

CVE-ID: CVE-2014-8917

Description: There are multiple cross-site scripting (XSS) vulnerabilities in the following IBM Dojo Toolkit files:
(1) dojox/form/resources/uploader.swf (upload.swf)
(2) dojox/form/resources/fileuploader.swf (fileupload.swf)
(3) dojox/av/resources/audio.swf
(4) dojox/av/resources/video.swf

These files, as used in IBM Social Media Analytics 1.3 before IF11 and other products, allow remote attackers to inject arbitrary web script or HTML by using unspecified vectors.

CVSS Base Score: 4.3
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/99303 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:M/Au:N/C:N/I:P/A:N)

Affected Products and Versions

IBM Case Manager 5.1.1 - Fix Pack 2 or prior
IBM Case Manager 5.2.0 - Fix Pack 2 or prior
IBM Case Manager 5.2.1 - Fix Pack 1 or prior

Remediation/Fixes

Product

VRMF
APAR
Remediation/First Fix
IBM Case Manager5.1.1.3N/A5.1.1.3-ICM-FP003 or later versions
IBM Case Manager5.2.0.2-IF001N/A5.2.0.2-ICM-IF001 or later versions
IBM Case Manager5.2.1.2N/A5.2.1.2-ICM-FP002 or later versions

IBM recommends that you review your entire environment to identify areas that uses the Dojo files that are listed in the Description section and take appropriate mitigation and remediation actions. The most immediate mitigation action that you can take is to remove these four Dojo files. Verify that removing these four Dojo files does not cause any issues, including compatibility issues.

Get Notified about Future Security Bulletins

Subscribe to My Notifications to be notified of important product support alerts like this.

References

Complete CVSS v2 Guide
On-line Calculator v2

Off

Related Information

IBM Secure Engineering Web Portal
IBM Product Security Incident Response Blog

*The CVSS Environment Score is customer environment specific and will ultimately impact the Overall CVSS Score. Customers can evaluate the impact of this vulnerability in their environments by accessing the links in the Reference section of this Security Bulletin.

Disclaimer

Review the IBM security bulletin disclaimer and definitions regarding your responsibilities for assessing potential impact of security vulnerabilities to your environment.

[{"Product":{"code":"SSCTJ4","label":"IBM Case Manager"},"Business Unit":{"code":"BU053","label":"Cloud & Data Platform"},"Component":"Not Applicable","Platform":[{"code":"PF002","label":"AIX"},{"code":"PF016","label":"Linux"},{"code":"PF027","label":"Solaris"},{"code":"PF033","label":"Windows"}],"Version":"5.2.1;5.2.0;5.1.1","Edition":"All Editions","Line of Business":{"code":"LOB45","label":"Automation"}}]

Product Synonym

Advanced Case Management;Case Manager;IBM Case Manager

Document Information

Modified date:
17 June 2018

UID

swg21883851

Page Feedback