CVE-2017-1750: XSS

Published Apr 25, 2018

Updated

IBM Jazz Reporting Service (JRS) 5.0 through 5.0.2 and 6.0 through 6.0.5 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 135523.

Affected Software

9 affected components

IBM Jazz Reporting Service=5.0

IBM Jazz Reporting Service=5.0.1

IBM Jazz Reporting Service=5.0.2

IBM Jazz Reporting Service=6.0

IBM Jazz Reporting Service=6.0.1

IBM Jazz Reporting Service=6.0.2

IBM Jazz Reporting Service=6.0.3

IBM Jazz Reporting Service=6.0.4

IBM Jazz Reporting Service=6.0.5

Remediation

Patch Available

http://www.ibm.com/support/docview.wss?uid=swg22015712

Event History

Apr 25, 2018

CVE Published

via MITRE·01:00 PM

Data Sourced

via MITRE·01:00 PM

DescriptionWeakness

Frequently Asked Questions

What is CVE-2017-1750?

CVE-2017-1750 is a vulnerability in IBM Jazz Reporting Service (JRS) 5.0 through 5.0.2 and 6.0 through 6.0.5 that allows for cross-site scripting.

How does CVE-2017-1750 affect IBM Jazz Reporting Service?

CVE-2017-1750 affects IBM Jazz Reporting Service versions 5.0 through 5.0.2 and 6.0 through 6.0.5 by allowing users to embed arbitrary JavaScript code in the Web UI, potentially leading to credentials disclosure within a trusted session.

What is the severity of CVE-2017-1750?

CVE-2017-1750 has a severity rating of medium with a score of 5.4.

How can I fix CVE-2017-1750?

To fix CVE-2017-1750, you should update IBM Jazz Reporting Service to a version that is not vulnerable, as recommended by IBM.

Where can I find more information about CVE-2017-1750?

You can find more information about CVE-2017-1750 on the IBM support website, the SecurityFocus website, and the IBM X-Force Exchange website.