Cross-site scripting in axios - CVE-2024-57965

Vulnerability identifier: #VU105862

CSH Severity: Medium

CVSS v4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]

CVE-ID: CVE-2024-57965

CWE-ID: CWE-79

Exploitation vector: Remote access

Exploit availability: No public exploit available

The disclosed vulnerability allows a remote attacker to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to lib/helpers/isURLSameOrigin.js does not use a URL object when determining an origin, and has a potentially unwanted setAttribute('href',href) call. A remote attacker can trick the victim to follow a specially crafted link and execute arbitrary HTML and script code in user's browser in context of vulnerable website.

Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.

axios
IBM Concert Software
Netcool Operations Insight
IBM Fusion HCI
IBM Watson Knowledge Catalog in Cloud Pak for Data
IBM Maximo Application Suite
IBM Business Automation Workflow
Voice Gateway
IBM Cloud Pak System
watsonx Orchestrate Cartridge for IBM Cloud Pak for Data
Knowledge Catalog Premium Cartridge
watsonx Orchestrate with watsonx Assistant Cartridge - UAB Component
Storage Ceph
Db2 Big SQL
Maximo Application Suite - Monitor Component
IBM License Metric Tool
IBM Security SOAR

Install updates from vendor's website.

axios - update to 1.7.8
IBM Concert Software - update to 2.0.0
Voice Gateway - update to 1.0.8.25
Netcool Operations Insight - update to 1.6.15
IBM Fusion HCI - update to 2.10.0
IBM Cloud Pak System - update to 2.3.6.0
watsonx Orchestrate Cartridge for IBM Cloud Pak for Data - update to 5.1.3
IBM Watson Knowledge Catalog in Cloud Pak for Data - addressed in versions 4.8.9, 5.1.3
Knowledge Catalog Premium Cartridge - update to 5.2
watsonx Orchestrate with watsonx Assistant Cartridge - UAB Component - update to 5.1.3
Storage Ceph - update to 8.1z1
Db2 Big SQL - update to 7.8.2
IBM Maximo Application Suite - addressed in versions 8.10.25, 8.11.22, 9.0.11
Maximo Application Suite - Monitor Component - addressed in versions 8.10.18, 8.11.16, 9.0.8
IBM License Metric Tool - update to 9.2.39
IBM Business Automation Workflow - addressed in versions 24.0.0-IF005, 24.0.1-IF002

• https://github.com/axios/axios/commit/0a8d6e19da5b9899a2abafaaa06a75ee548597db
• https://github.com/axios/axios/issues/6351
• https://github.com/axios/axios/pull/6714
• https://github.com/axios/axios/releases/tag/v1.7.8

• Cross-site scripting in axios
• Multiple vulnerabilities in IBM License Metric Tool
• Multiple vulnerabilities in IBM Voice Gateway
• Multiple vulnerabilities in IBM Business Automation Workflow
• IBM watsonx Orchestrate with watsonx Assistant Cartridge update for axios
• IBM Maximo Application Suite - Monitor Component update for axios
• Multiple vulnerabilities in IBM Fusion
• Multiple vulnerabilities in IBM Cloud Pak System
• Multiple vulnerabilities in IBM Watson Knowledge Catalog
• IBM Maximo Application Suite update for axios
• IBM watsonx Orchestrate with watsonx Assistant Cartridge - UAB Component update for axios
• Multiple vulnerabilities in IBM Concert Software
• Multiple vulnerabilities in IBM Security SOAR
• Multiple vulnerabilities in Netcool Operations Insight
• IBM Storage Ceph update for axios
• IBM Db2 Big SQL on Cloud Pak for Data update for axios
• Multiple vulnerabilities in IBM Knowledge Catalog Premium Cartridge