JR64339: MULTIPLE SECURITY VULNERABILITIES IN JQUERY USED BY SWAGGER UI

8.5.7.201706-WS-BPM-IFJR64339
8.6.0.201803-WS-BPM-IFJR64339
8.6.10019003-WS-BPM-IFJR64339
8.6.20020002-WS-BPM-IFJR64339
8.6.20021020-WS-BPM-IFJR64339

APAR status

• Closed as program error.

Error description

• CVEID:   CVE-2020-11022
  DESCRIPTION:   jQuery is vulnerable to cross-site scripting,
  caused by improper validation of user-supplied input by the
  jQuery.htmlPrefilter method. A remote attacker could exploit
  this vulnerability to inject malicious script into a Web page
  which would be executed in a victim's Web browser within the
  security context of the hosting Web site, once the page is
  viewed. An attacker could use this vulnerability to steal the
  victim's cookie-based authentication credentials.
  CVSS Base score: 6.1
  CVSS Temporal Score: See:
  https://exchange.xforce.ibmcloud.com/vulnerabilities/181349 for
  the current score.
  CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
  
  CVEID:   CVE-2020-11023
  DESCRIPTION:   jQuery is vulnerable to cross-site scripting,
  caused by improper validation of user-supplied input by the
  option elements. A remote attacker could exploit this
  vulnerability to inject malicious script into a Web page which
  would be executed in a victim's Web browser within the security
  context of the hosting Web site, once the page is viewed. An
  attacker could use this vulnerability to steal the victim's
  cookie-based authentication credentials.
  CVSS Base score: 6.1
  CVSS Temporal Score: See:
  https://exchange.xforce.ibmcloud.com/vulnerabilities/181350 for
  the current score.
  CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
  

Local fix

Problem summary

• No additional information is available.
  
  PRODUCT AFFECTED:
  IBM Business Automation Workflow
  IBM Cloud Pak for Business Automation
  

Problem conclusion

• A fix is available that updates the jQuery in Swagger UI.
  

Temporary fix

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

Fix information

• Fixed component name

  BUS AUTO WORKFL

• Fixed component ID

  5737H4100

Applicable component levels