Cross-site scripting in Dojo - CVE-2018-6561
Published: February 2, 2018 / Updated: January 30, 2021
Vulnerability identifier: #VU37568
CSH Severity: Low
CVSS v4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]
CVE-ID: CVE-2018-6561
CWE-ID: CWE-79
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The disclosed vulnerability allows a remote attacker to perform cross-site scripting (XSS) attacks via the onload attribute of an SVG element.
The vulnerability exists due to insufficient sanitization of user-supplied data. A remote attacker can trick the victim to follow a specially crafted link and execute arbitrary HTML and script code in user's browser in context of vulnerable website.
Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.
Affected software
Dojo
IBM Cloud Pak System
Financial Transaction Manager for ACH Services and Check Services
IBM Security Guardium Key Lifecycle Manager (GKLM)
WebSphere eXtreme Scale
IBM Security Verify Governance
IBM Cloud Pak System
Financial Transaction Manager for ACH Services and Check Services
IBM Security Guardium Key Lifecycle Manager (GKLM)
WebSphere eXtreme Scale
IBM Security Verify Governance
How to mitigate CVE-2018-6561
Install update from vendor's website.
IBM Cloud Pak System - update to 2.3.3.7 iFix 01
Financial Transaction Manager for ACH Services and Check Services - update to 3.0.5.4 iFix 28
IBM Security Guardium Key Lifecycle Manager (GKLM) - update to 4.2
WebSphere eXtreme Scale - update to 8.6.1.6 PH60890 iFix
IBM Security Verify Governance - update to 10.0.2.0.2
Financial Transaction Manager for ACH Services and Check Services - update to 3.0.5.4 iFix 28
IBM Security Guardium Key Lifecycle Manager (GKLM) - update to 4.2
WebSphere eXtreme Scale - update to 8.6.1.6 PH60890 iFix
IBM Security Verify Governance - update to 10.0.2.0.2
External References
Related Security Bulletins
- Cross-site scripting in Dojo
- Cross-site scripting in IBM Security Guardium Key Lifecycle Manager (SKLM/GKLM)
- IBM Cloud Pak System update for dojo
- Multiple vulnerabilities in IBM Security Verify Governance - Identity Manager, Container
- Multiple vulnerabilities in IBM WebSphere Extreme Scale
- Multiple vulnerabilities in IBM Financial Transaction Manager for ACH Services and Check Services for Multi-Platform