CVE-2020-4298

CWE-79 — Cross-site Scripting (XSS)5 documents4 sources

Severity

5.4MEDIUM

EPSS

0.2%

top 60.44%

CISA KEV

Not in KEV

Exploit

No known exploits

Affected products

IBM Infosphere Information Server IBM Infosphere Information Server ON Cloud

Timeline

PublishedMay 19

Latest updateMay 24

Description

IBM InfoSphere Information Server 11.3, 11.5, and 11.7 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 176475.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:NExploitability: 2.3 | Impact: 2.7

Affected Packages3 packages

▶CVEListV5ibm/infosphere_information_server11.3, 11.5, 11.7+2

▶NVDibm/infosphere_information_server11.3

▶NVDibm/infosphere_information11.5, 11.7+1

Patches

Patch: www.ibm.com ↗Patch: www.ibm.com ↗

🔴Vulnerability Details

GHSA

GHSA-3h4q-7386-ff6m: IBM InfoSphere Information Server 11↗2022-05-24

▶

CVEList

CVE-2020-4298: IBM InfoSphere Information Server 11↗2020-05-19

▶

💬Community

Bugzilla

CVE-2020-14336 ose-machine-config-operator-container: openshift: restricted SCC allows pods to craft custom network packets [openshift-4]↗2020-09-01

▶

Bugzilla

CVE-2020-13822 nodejs-elliptic: improper encoding checks allows a certain degree of signature malleability in ECDSA signatures↗2020-06-18

▶