IT44187: IBM STORAGE INSIGHTS SECURITY APAR FOR STORED CROSS -SITE SCRIPTING

APAR status

• Closed as program error.

Error description

• Stored cross -site scripting occurs when a web application
  gathers input from a user which
  might be malicious, and then stores that input in a data store
  for later use. The input that is
  stored is not validated. Therefore, the malicious data will
  appear to be part of the web page
  and gets executed within the user's browser under the privileges
  of the web application. The
  malicious user input/payload might be stored and used in
  multiple pages/functionalities and
  the execution of the payload will be dependent on how the page
  is being rendered.
  

Local fix

Problem summary

• ****************************************************************
  * USERS AFFECTED:                                              *
  * IBM Storage Insights users                                   *
  *                                                              *
  ****************************************************************
  * PROBLEM DESCRIPTION:                                         *
  * SECURITY APAR FOR:                                           *
  * Cross Site Scripting (Stored)                                *
  ****************************************************************
  * RECOMMENDATION:                                              *
  ****************************************************************
  

Problem conclusion

• The fix for this APAR is contained in the following release:
  
  IBM Storage Insights 3Q23   [ 54X-IBM-SI ]
  ( 3Q 2023 / July )
  
  To protect IBM Storage Insights against emerging
  security vulnerabilities, the service was updated to
  protected against vulnerabilities.
  
  No action is required, there is nothing that you need
  to do following the IBM Storage Insights upgrade.
  

Temporary fix

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

Fix information

• Fixed component name

  STORAGE INSIGHT

• Fixed component ID

  5608TPCSI

Applicable component levels