CVE-2018-1363: XSS

Published Apr 25, 2018

Updated

IBM Jazz Reporting Service (JRS) 5.0 through 5.0.2 and 6.0 through 6.0.5 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 137448.

Affected Software

9 affected components

IBM Jazz Reporting Service=5.0

IBM Jazz Reporting Service=5.0.1

IBM Jazz Reporting Service=5.0.2

IBM Jazz Reporting Service=6.0

IBM Jazz Reporting Service=6.0.1

IBM Jazz Reporting Service=6.0.2

IBM Jazz Reporting Service=6.0.3

IBM Jazz Reporting Service=6.0.4

IBM Jazz Reporting Service=6.0.5

Remediation

Patch Available

http://www.ibm.com/support/docview.wss?uid=swg22015712

Event History

Apr 25, 2018

CVE Published

via MITRE·01:00 PM

Data Sourced

via MITRE·01:00 PM

DescriptionWeakness

Frequently Asked Questions

What is CVE-2018-1363?

CVE-2018-1363 is a vulnerability in IBM Jazz Reporting Service that allows for cross-site scripting attacks.

How does CVE-2018-1363 impact IBM Jazz Reporting Service?

CVE-2018-1363 allows users to embed arbitrary JavaScript code in the Web UI, potentially leading to credentials disclosure within a trusted session.

What is the severity of CVE-2018-1363?

CVE-2018-1363 has a medium severity rating with a CVSS score of 5.4.

Which versions of IBM Jazz Reporting Service are affected by CVE-2018-1363?

IBM Jazz Reporting Service versions 5.0 through 5.0.2 and 6.0 through 6.0.5 are affected by CVE-2018-1363.

How can I fix CVE-2018-1363?

To fix CVE-2018-1363, it is recommended to upgrade to a patched version of IBM Jazz Reporting Service.