APAR status
Closed as program error.
Error description
Summary Security Bulletin: IBM Robotic Process Automation is vunerable to cross-site scripting through Prism.js (CVE-2022-23647) Vulnerability Details CVEID: CVE-2022-23647 DESCRIPTION: Prism.js Prism is vulnerable to cross-site scripting, caused by improper validation of user-supplied input by the Command line plugin. A remote attacker could exploit this vulnerability to inject malicious script into a Web page which would be executed in a victim's Web browser within the security context of the hosting Web site, once the page is viewed. An attacker could use this vulnerability to steal the victim's cookie-based authentication credentials. CVSS Base score: 7.5 CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/219962 for the current score. CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:L/A:L)
Local fix
Problem summary
**************************************************************** * USERS AFFECTED: * * All * **************************************************************** * PROBLEM DESCRIPTION: * * No further information. * **************************************************************** * RECOMMENDATION: * ****************************************************************
Problem conclusion
First fixed in 21.0.2 IF004
Temporary fix
Comments
APAR Information
APAR number
JR65047
Reported component name
RPA
Reported component ID
5737N5100
Reported release
L00
Status
CLOSED PER
PE
NoPE
HIPER
NoHIPER
Special Attention
NoSpecatt / Xsystem
Submitted date
2022-06-16
Closed date
2022-06-16
Last modified date
2022-06-16
APAR is sysrouted FROM one or more of the following:
APAR is sysrouted TO one or more of the following:
Fix information
Fixed component name
RPA
Fixed component ID
5737N5100
Applicable component levels
[{"Line of Business":{"code":"LOB45","label":"Automation"},"Business Unit":{"code":"BU059","label":"IBM Software w\/o TPS"},"Product":{"code":"SSC50T","label":"IBM Robotic Process Automation"},"Platform":[{"code":"PF025","label":"Platform Independent"}],"Version":"L00"}]
Document Information
Modified date:
17 June 2022