Security Bulletin: HTML comments with sensitive information could be present in IBM Workload Scheduler

Summary

HTML comments with sensitive information, as file locations, machine or user names, could be present in IBM Dynamic Workload Console 9.5

Vulnerability Details

CVEID:CVE-2020-4673
**DESCRIPTION:**IBM Workload Automation stores sensitive information in HTML comments that could aid in further attacks against the system.
CVSS Base score: 4.3
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/186286 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N)

Affected Products and Versions

Remediation/Fixes

APAR IJ30010 has been opened to address CVE-2020-4673.
Apar IJ30010 has been included in IBM Workload Scheduler 9.5 FP03 and it is already available on FixCentral.

Workarounds and Mitigations

None