CVE-2017-1096: XSS
IBM Jazz Reporting Service (JRS) 5.0 and 6.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 120656.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2017-1096?
CVE-2017-1096 is considered a medium severity vulnerability due to its potential for cross-site scripting attacks.
How do I fix CVE-2017-1096?
To fix CVE-2017-1096, upgrade to the latest version of IBM Jazz Reporting Service that addresses the cross-site scripting vulnerability.
What versions of IBM Jazz Reporting Service are affected by CVE-2017-1096?
CVE-2017-1096 affects IBM Jazz Reporting Service versions 5.0, 5.0.1, 5.0.2, 6.0, 6.0.1, 6.0.2, and 6.0.3.
What are the risks associated with CVE-2017-1096?
The risks associated with CVE-2017-1096 include the potential for credentials disclosure and unauthorized actions within a trusted session through injected JavaScript.
Is authentication required to exploit CVE-2017-1096?
Yes, exploitation of CVE-2017-1096 requires the attacker to already be authenticated within the application.