CVE-2021-38966: XSS
IBM Cloud Pak for Automation 21.0.2 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 212357.
Affected Software
Event History
Frequently Asked Questions
What is the vulnerability ID for this cross-site scripting vulnerability?
The vulnerability ID for this cross-site scripting vulnerability is CVE-2021-38966.
What is the severity of CVE-2021-38966?
The severity of CVE-2021-38966 is medium.
How does the cross-site scripting vulnerability in IBM Cloud Pak for Automation 21.0.2 work?
The cross-site scripting vulnerability allows users to embed arbitrary JavaScript code in the Web UI, potentially leading to credentials disclosure within a trusted session.
Which software versions are affected by CVE-2021-38966?
IBM Cloud Pak for Automation version 21.0.2 and IBM ICP4A - Workflow Process Services version 21.0.2 are affected by CVE-2021-38966.
How can I fix the cross-site scripting vulnerability in IBM Cloud Pak for Automation 21.0.2?
To fix the cross-site scripting vulnerability, update to a version of IBM Cloud Pak for Automation that is not affected by CVE-2021-38966.