CVE-2020-4298: XSS

Published May 19, 2020

Updated

IBM InfoSphere Information Server 11.3, 11.5, and 11.7 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 176475.

Affected Software

3 affected components

IBM InfoSphere Information Server=11.3

IBM Infosphere Information Server On Cloud=11.5

IBM Infosphere Information Server On Cloud=11.7

Remediation

Patch Available

https://www.ibm.com/support/pages/node/6194775

Event History

May 18, 2020

CVE Published

via MITRE·12:00 AM

Data Sourced

via MITRE·12:00 AM

DescriptionSeverityWeakness

Frequently Asked Questions

What is the severity of CVE-2020-4298?

The severity of CVE-2020-4298 is medium.

How does CVE-2020-4298 affect IBM InfoSphere Information Server?

CVE-2020-4298 allows users to embed arbitrary JavaScript code in the Web UI of IBM InfoSphere Information Server, potentially leading to credentials disclosure within a trusted session.

Which versions of IBM InfoSphere Information Server are affected by CVE-2020-4298?

IBM InfoSphere Information Server versions 11.3, 11.5, and 11.7 are affected by CVE-2020-4298.

What is the Common Weakness Enumeration (CWE) ID for CVE-2020-4298?

The CWE ID for CVE-2020-4298 is CWE-79.

How can I fix CVE-2020-4298 in IBM InfoSphere Information Server?

To fix CVE-2020-4298, apply the necessary security patches or updates provided by IBM.