CVE-2018-1895: XSS
First published: Fri Feb 15 2019(Updated: )
IBM InfoSphere Information Server 11.3, 11.5, and 11.7 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 152159.
Credit: psirt@us.ibm.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| IBM InfoSphere Information Governance Catalog | =11.3 | |
| IBM InfoSphere Information Governance Catalog | =11.5 | |
| IBM InfoSphere Information Governance Catalog | =11.7 | |
| Ibm Infosphere Information Server On Cloud | =11.5 | |
| Ibm Infosphere Information Server On Cloud | =11.7 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is CVE-2018-1895 vulnerability?
CVE-2018-1895 is a cross-site scripting vulnerability in IBM InfoSphere Information Server 11.3, 11.5, and 11.7.
How does the vulnerability in IBM InfoSphere Information Server 11.3, 11.5, and 11.7 work?
The vulnerability allows users to inject arbitrary JavaScript code in the Web UI, potentially leading to credentials disclosure within a trusted session.
What is the severity of CVE-2018-1895 vulnerability?
The severity of CVE-2018-1895 vulnerability is medium with a score of 5.4.
Which IBM products are affected by CVE-2018-1895 vulnerability?
IBM InfoSphere Information Governance Catalog 11.3, 11.5, and 11.7, as well as IBM InfoSphere Information Server On Cloud 11.5 and 11.7, are affected by this vulnerability.
How can I fix the CVE-2018-1895 vulnerability?
Update IBM InfoSphere Information Server to the latest version to mitigate the vulnerability. Refer to the provided IBM support documentation for more information.
- collector/nvd-index
- agent/references
- agent/type
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/author
- agent/weakness
- agent/severity
- agent/softwarecombine
- agent/tags
- agent/description
- agent/first-publish-date
- agent/event
- vendor/ibm
- canonical/ibm infosphere information governance catalog
- version/ibm infosphere information governance catalog/11.3
- version/ibm infosphere information governance catalog/11.5
- version/ibm infosphere information governance catalog/11.7
- canonical/ibm infosphere information server on cloud
- version/ibm infosphere information server on cloud/11.5
- version/ibm infosphere information server on cloud/11.7