CVE-2020-4909: XSS

Q: What is the vulnerability ID for this vulnerability?

The vulnerability ID for this vulnerability is CVE-2020-4909.

Q: What is the severity of CVE-2020-4909?

The severity of CVE-2020-4909 is medium.

Q: How does CVE-2020-4909 affect IBM Cloud Pak System?

CVE-2020-4909 affects IBM Cloud Pak System 2.3.

Q: What is the impact of CVE-2020-4909?

CVE-2020-4909 allows users to embed arbitrary JavaScript code in the Web UI, potentially leading to credentials disclosure within a trusted session.

Q: How can I fix CVE-2020-4909?

To fix CVE-2020-4909, it is recommended to apply the necessary patches or updates provided by IBM.

Published Nov 17, 2020

Updated

IBM Cloud Pak System 2.3 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 191273.

Other sources

IBM Cloud Pak System is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.

Affected Software

2 affected components

IBM Cloud Pak System>=2.3.0.0<2.3.3.3

IBM Cloud Pak System<=2.3

Remediation

Patch Available

https://www.ibm.com/support/pages/node/6393554

Event History

Nov 17, 2020

CVE Published

via IBM·12:00 AM

Jan 4, 2021

CVE Published

via MITRE·02:00 PM

Data Sourced

via MITRE·02:00 PM

DescriptionSeverityWeakness

Parent advisories

This vulnerability appears in the following advisories.

IBM-6393554

Frequently Asked Questions

What is the vulnerability ID for this vulnerability?

The vulnerability ID for this vulnerability is CVE-2020-4909.

What is the severity of CVE-2020-4909?