IBM Jazz Reporting Service LQE XSS Vulnerability Advisory (CVE-2018-1918)

Security Bulletin: Security Vulnerability in Lifecycle Query Engine (LQE) Affecting Security Provided by Jazz Reporting Service (CVE-2018-1918) Summary A security vulnerability exists in the Lifecycle Query Engine (LQE) that affects the security provided by Jazz Reporting Service. Vulnerability Details CVE ID: CVE-2018-1918 DESCRIPTION: IBM Jazz Reporting Service (JRS) is vulnerable to a Cross-Site Scripting (XSS) vulnerability. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI, potentially altering intended functionality and leading to credential leakage within trusted sessions. CVSS Base Score: 5.4 CVSS Temporal Score: Query Temporal Score CVSS Environment Score: Not defined CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) Affected Products and Versions Jazz Reporting Service 6.0.3, 6.0.4, 6.0.5, and 6.0.6. Temporary Fix / Patch Apply the recommended fix to all affected versions of Jazz Reporting Service. Workarounds and Mitigations None Subscribe to Future Security Bulletins Subscribe to My Notifications to receive notifications about important product support alerts like this one. References IBM Security Engineers Web Portal IBM Security Response Blog History January 4, 2019: Initial release Disclaimer See the IBM Security Bulletin Disclaimer and Definitions page for information regarding the responsibility for assessing the potential impact of security vulnerabilities on your environment.

Goal Reached Thanks to every supporter — we hit 100%!

IBM Jazz Reporting Service LQE XSS Vulnerability Advisory (CVE-2018-1918)