SB2018070614 - Multiple vulnerabilities in IBM FileNet Content Manager and Content Foundation
Published: July 9, 2018 Updated: July 9, 2018
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 3 secuirty vulnerabilities.
1) XXE attack (CVE-ID: CVE-2018-1542)
The disclosed vulnerability allows a remote authenticated attacker to perform XXE attack.
The weakness exists due to an error when processing malicious XML data. A remote attacker can supply specially crafted XML External Entity (XXE) data to the target Administration Console for Content Platform Engine (ACCE) interface component to read files with elevated privileges or consume excessive memory and cause the service to crash.
2) Cross-site scripting (CVE-ID: CVE-2018-1555)
The disclosed vulnerability allows a remote attacker to perform cross-site scripting (XSS) attacks.
The vulnerability exists due to insufficient sanitization of user-supplied data. A remote attacker can trick the victim to follow a specially crafted link and execute arbitrary HTML and script code in user's browser in context of vulnerable website.
Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.
3) Cross-site scripting (CVE-ID: CVE-2018-1556)
The disclosed vulnerability allows a remote attacker to perform cross-site scripting (XSS) attacks.
The vulnerability exists due to insufficient sanitization of user-supplied data. A remote attacker can trick the victim to follow a specially crafted link and execute arbitrary HTML and script code in user's browser in context of vulnerable website.
Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.
Remediation
Install update from vendor's website.