Security Bulletin:  IBM Content Manager Enterprise Edition Resource Manager is affected by a Remote Code Execution Cross-site Scripting vulnerability

Summary

IBM Content Manager Enterprise Edition Resource Manager has addressed the following vulnerability

Vulnerability Details

CVEID: CVE-2018-1502
DESCRIPTION: IBM Content Manager Enterprise Edition Resource Manager is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.
CVSS Base Score: 5.4
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/141338 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N)

Affected Products and Versions

Affected Content Manager Enterprise Edition

|

Affected Versions

—|—
Content Manager Enterprise Edition | 8.4.3
Content Manager Enterprise Edition | 8.5

Remediation/Fixes

Product

| Version |Remediation
—|—|—
Content Manager Enterprise Edition | 8.4.3 | Migrate to higher version
Content Manager Enterprise Edition | 8.5 | _Use _CMEE 8.5.0.600 testfix9 available at https://www.ibm.com/support/fixcentral/

Workarounds and Mitigations

None