IBM Support

Security Bulletin: IBM Cognos Analytics はクロスサイトスクリプティング(XSS)の脆弱性の影響を受けます

Created by Aya Mori on
Published URL:
https://www.ibm.com/support/pages/node/567111
567111

Security Bulletin


Summary

IBM Cognos Analytics 11.0, 11.0.1, 11.0.2, 11.0.3にはユーザーの入力に対する不適切な検証によるクロスサイトスクリプティング(XSS)の脆弱性があります。

Vulnerability Details

CVEID: CVE-2016-0346
説明：IBM Cognos Analyticsはユーザーの入力に対する不適切な検証によるクロスサイトスクリプティング(XSS)の脆弱性があります。リモート・アタッカーは、一度ページが閲覧されれば被害者のWebブラウザーで実行されているWebサイトのセキュリティ・コンテキストのWebページの中に悪意のあるスクリプトを紛れ込ませることができます。攻撃者はこの脆弱性を利用して被害者のクッキーに基づく承認情報を盗むことが可能です。
CVSS Base Score: 5.4
CVSS Temporal Score: 最新のスコアはこちらをご連ください。 https://exchange.xforce.ibmcloud.com/vulnerabilities/111787
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N)

Affected Products and Versions

IBM Cognos Analytics Versions 11.0.0.0 to 11.0.3.0

Remediation/Fixes

可能な限り早く11.0.4以上を適用してください。
11.0.4は下記からダウンロード頂けます。

http://www.ibm.com/support/docview.wss?uid=swg24042763

Get Notified about Future Security Bulletins

Subscribe to My Notifications to be notified of important product support alerts like this.

References

Complete CVSS v2 Guide
On-line Calculator v2

Off

Related Information

IBM Secure Engineering Web Portal
IBM Product Security Incident Response Blog

*The CVSS Environment Score is customer environment specific and will ultimately impact the Overall CVSS Score. Customers can evaluate the impact of this vulnerability in their environments by accessing the links in the Reference section of this Security Bulletin.

Disclaimer

Review the IBM security bulletin disclaimer and definitions regarding your responsibilities for assessing potential impact of security vulnerabilities to your environment.

Internal Use Only

DCF 2004980

[{"Product":{"code":"SSTSF6","label":"IBM Cognos Analytics"},"Business Unit":{"code":"BU048","label":"IBM Software"},"Component":"Administration and Configuration v11x","Platform":[{"code":"PF025","label":"Platform Independent"}],"Version":"11.0.3;11.0.2;11.0.1;11.0","Edition":"All Editions","Line of Business":{"code":"LOB10","label":"Data and AI"}},{"Product":{"code":"SSTSF6","label":"IBM Cognos Analytics"},"Business Unit":{"code":"BU048","label":"IBM Software"},"Component":" ","Platform":[{"code":"","label":""}],"Version":"","Edition":"","Line of Business":{"code":"LOB10","label":"Data and AI"}}]

Document Information

Modified date:
02 October 2024

UID

swg22007549

Page Feedback