JR65047: SECURITY BULLETIN: IBM ROBOTIC PROCESS AUTOMATION IS VUNERABLE TO CROSS-SITE SCRIPTING THROUGH PRISM.JS (CVE-2022-23647)

APAR status

• Closed as program error.

Error description

• Summary
  
  Security Bulletin: IBM Robotic Process Automation is vunerable
  to cross-site scripting through Prism.js (CVE-2022-23647)
  
  
  Vulnerability Details
  
  CVEID:   CVE-2022-23647
  DESCRIPTION:   Prism.js Prism is vulnerable to cross-site
  scripting, caused by improper validation of user-supplied input
  by the Command line plugin. A remote attacker could exploit this
  vulnerability to inject malicious script into a Web page which
  would be executed in a victim's Web browser within the security
  context of the hosting Web site, once the page is viewed. An
  attacker could use this vulnerability to steal the victim's
  cookie-based authentication credentials.
  CVSS Base score: 7.5
  CVSS Temporal Score: See:
  https://exchange.xforce.ibmcloud.com/vulnerabilities/219962 for
  the current score.
  CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:L/A:L)
  

Local fix

Problem summary

• ****************************************************************
  * USERS AFFECTED:                                              *
  * All                                                          *
  ****************************************************************
  * PROBLEM DESCRIPTION:                                         *
  * No further information.                                      *
  ****************************************************************
  * RECOMMENDATION:                                              *
  ****************************************************************
  

Problem conclusion

• First fixed in 21.0.2 IF004
  

Temporary fix

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

Fix information

• Fixed component name

  RPA

• Fixed component ID

  5737N5100

Applicable component levels