IBM0FF2EF4A18D05D26A8A567CCA407783DC2374BCE4E2B190C96C579B4FEF6BE25Security Bulletin: IBM Intelligent Operations Center is vulnerable to Stored Cross-Site Scripting (CVE-2020-4317)
EPSS
Percentile
19.6%
Summary
IBM Intelligent Operations Center is vulnerable to Stored Cross-Site Scripting.
Vulnerability Details
CVEID:CVE-2020-4317
**DESCRIPTION:**IBM Intelligent Operations Center for Emergency Management, Intelligent Operations Center (IOC) is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.
CVSS Base score: 5.4
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/177355 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N)
Affected Products and Versions
| Affected Product(s) | Version(s) |
|---|---|
| Intelligent Operations Center (IOC) | 5.1.0, 5.1.0.2, 5.1.0.3, 5.1.0.4, 5.1.0.6, 5.2, 5.2. |
| IBM Water Operations for Waternamics (Linux) | 5.1.0, 5.1.0.2, 5.1.0.3, 5.1.0.4, 5.1.0.6, 5.2, 5.2.1 |
| IBM Intelligent Operations Center for Emergency Management (Linux) | 5.1.0, 5.1.0.2, 5.1.0.3, 5.1.0.4, 5.1.0.6 |
Remediation/Fixes
The recommended solution is to apply an interim fix that contains the fix for this issue as soon as practical.
Download the IBM Intelligent Operations Center Version 5.2.1.1 is an upgrade to IBM Intelligent Operations Center Version 5.1 through IBM Intelligent Operations Center Version 5.2 from the following link: IBM Intelligent Operations Center Version 5.2.1.1. Installation instructions for the fix are included in the readme document that is in the fix package.
Workarounds and Mitigations
None
Related
EPSS
Percentile
19.6%