IV98382: Platform is vulnerable to Cross-frame scripting vulnerability / clickjacking.

3.5.3-TIV-TAP-FP005-README
3.5.3-TIV-TAP-FP005-WIN
3.5.3-TIV-TAP-FP005-LIN
3.5.3-TIV-TAP-FP005-AIX
3.5.3-TIV-TAP-FP001-WIN
3.5.3-TIV-TAP-FP001-README
3.5.3-TIV-TAP-FP001-LIN
3.5.3-TIV-TAP-FP001-AIX

APAR status

• Closed as fixed if next.

Error description

• Problem type:
  Platform - Cross-frame scripting - Security
  
  Found (and Reproduced) in Product Version:
  Identified on 3.4.2.5 and Reproduced in 3.4.2.5. Issue is
  resolved with TRIRIGA 3.6.0.0
  
  Problem Title:
  Platform is vulnerable to Cross-frame scripting vulnerability /
  clickjacking.
  
  Description:
  Platform is vulnerable to Cross-frame scripting
  
  Steps to Reproduce:
  NA
  
  Fixed in version:
  TRIRIGA Application Version 3.6.0.0
  
  Fix Description:
  To exclude cross-frame scripting, add the following to the
  TRIRIGAWEB.properties file:
  httpheader.X-Frame-Options=SAMEORIGIN (Tri-276768-IV98382)
  
  Keywords:
  None
  
  Work-Arounds:
  None
  

Local fix

• This issue is resolved in 3.6.0.0
  

Problem summary

• Need to add a http header to tell the brower to not allow
  cross-frame scripting.
  

Problem conclusion

• This issue has been resolved by enhancement 270641.
  Please add the following to the TRIRIGAWEB.properties
  configuration file.
  httpheader.X-Frame-Options=SAMEORIGIN
  This is targeted to the 2h2017 release as well as the 3.5.3.1
  fix pack.
  

Temporary fix

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

Modules/Macros

• 999
  

Fix information

Applicable component levels