Multiple vulnerabilities have been found in the Bleach package, which is either built in to or distributed with IBM WMLCE.
CVEID:CVE-2020-6816
**DESCRIPTION:**Mozilla Bleach is vulnerable to cross-site scripting, caused by improper validation of user-supplied input by the bleach.clean. A remote attacker could exploit this vulnerability using the svg or math in the allowed/allowlisted tags to inject malicious script into a Web page which would be executed in a victim’s Web browser within the security context of the hosting Web site, once the page is viewed. An attacker could use this vulnerability to steal the victim’s cookie-based authentication credentials.
CVSS Base score: 6.1
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/178671 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
CVEID:CVE-2020-6802
**DESCRIPTION:**Mozilla Bleach is vulnerable to cross-site scripting, caused by improper validation of user-supplied input by the bleach.clean A remote attacker could exploit this vulnerability using a raw tag in the allowed/allowlisted tags option to inject malicious script into a Web page which would be executed in a victim’s Web browser within the security context of the hosting Web site, once the page is viewed. An attacker could use this vulnerability to steal the victim’s cookie-based authentication credentials.
CVSS Base score: 6.1
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/178672 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Affected Product(s) | Version(s) |
---|---|
IBM WML Community Edition | 1.6.2 |
IBM WML Community Edition | 1.7.0 |
All IBM WMLCE distribution channels have been updated. For those using containers, pulling the image again from its upstream container registry (<https://hub.docker.com/r/ibmcom/powerai>, <https://catalog.redhat.com>, etc) will download an updated image with CVEs resolved. All others should update directly from our conda channel via conda update
.
None
CPE | Name | Operator | Version |
---|---|---|---|
ibm powerai | eq | 1.6.2 | |
ibm powerai | eq | 1.7.0 |